New XML PropertyListDecoder parser accepts malformed tags #1180
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jmschonfeld
approved these changes
Feb 18, 2025
|
@swift-ci please test |
jmschonfeld
added a commit
that referenced
this pull request
Feb 20, 2025
#1180 accidentally introduces a build issue on macOS due to new ambiguity between Foundation.String.Encoding and FoundationEssentials.String.Encoding but we weren't able to detect that since macOS CI is currently nonfunctional. This fixes the ambiguity using the same trick we use elsewhere in our unit tests. I've validated locally that this fixes the build issues on macOS.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A mistake was made during translation of PropertyListSerialization XML parsing to native PropertyListDecoder with regard to open tags.
PropertyListSerializationaccepts open tags that look like any of the following:The latter case is to handle tags with attributes, which are typically only used on the
plisttag, e.g.<plist version="1.0">.The adapted code was too permissive and accepted:
Which means we accepted input like:
This PR fixes that by checking the next character after a valid tag name before accepting it.