Merge pull request #751 from llelf/sec1

Straighten security

Author: Martin Cox

src/yz_wm_search.erl

@@ -23,8 +23,6 @@
 -include("yokozuna.hrl").
 -include_lib("webmachine/include/webmachine.hrl").
 
--define(YZ_HEAD_FPROF, "yz-fprof").
-
 -record(ctx, {security      %% security context
              }).
 
@@ -121,8 +119,6 @@ search(Req, S) ->
     search(Req, S, Params).
 
 search(Req, S, Params) ->
-    {FProf, FProfFile} = check_for_fprof(Req),
-    ?IF(FProf, fprof:trace(start, FProfFile)),
     T1 = os:timestamp(),
     Index = list_to_binary(wrq:path_info(index, Req)),
     try
@@ -155,26 +151,13 @@ search(Req, S, Params) ->
             ErrReq2 = wrq:set_resp_header("Content-Type", "text/plain",
                                         ErrReq),
             {{halt, Code}, ErrReq2, S}
-    after
-        ?IF(FProf, fprof_analyse(FProfFile))
     end.
 
 %% @doc Solr returns as chunked but not going to return as chunked from
 %%      Yokozuna.
 scrub_headers(RespHeaders) when is_list(RespHeaders) ->
     lists:keydelete("Transfer-Encoding", 1, RespHeaders).
 
-check_for_fprof(Req) ->
-    case wrq:get_req_header(?YZ_HEAD_FPROF, Req) of
-        undefined -> {false, none};
-        File -> {true, File}
-    end.
-
-fprof_analyse(FileName) ->
-    fprof:trace(stop),
-    fprof:profile(file, FileName),
-    fprof:analyse([{dest, FileName ++ ".analysis"}, {cols, 120}]).
-
 -spec resource_exists(term(), term()) -> {boolean(), term(), term()}.
 resource_exists(RD, Context) ->
     IndexName = list_to_binary(wrq:path_info(index, RD)),

src/yz_xml_extractor.erl

@@ -56,7 +56,12 @@ extract(Value, Opts) ->
     extract_fields(Value, #state{field_separator=Sep}).
 
 extract_fields(Data, State) ->
-    Options = [{event_fun, fun sax_cb/3}, {event_state, State}],
+    Options = [
+               {file_type, normal},
+               skip_external_dtd,
+               {event_fun, fun sax_cb/3},
+               {event_state, State}
+              ],
     case xmerl_sax_parser:stream(Data, Options) of
         {ok, State2, _Rest} ->
             State2#state.fields;
@@ -88,6 +93,9 @@ sax_cb({characters, Value}, _Location, S) ->
     Field = {Name, unicode:characters_to_binary(Value)},
     S#state{fields = [Field|S#state.fields]};
 
+sax_cb({externalEntityDecl,_,_,_}, _, _State) ->
+    throw(external_entity_disarmed);
+
 sax_cb(_Event, _Location, State) ->
     State.