mozilla-releng / balrog / #5720

90%

main: 90%

Pull #3874

circleci

Bug 2063240 - Enforce XML attribute escaping by construction

Escaping was applied at each call site by hand, so the invariant "every
attribute value is escaped" was not enforced anywhere and a new emit site
could silently reintroduce injection.

Route all attribute serialisation through a single renderXMLAttributes
helper that escapes every value (and lower-cases booleans). Every emit
site (apprelease update lines + patches, DesupportBlob, gmp and
systemaddons addons/mirrors) now builds (name, value) pairs and calls it,
so raw name="%s" interpolation no longer exists in the blob code and a
value cannot reach a response without being escaped. Output is
byte-identical, as verified by the existing exact-XML assertions.

Add tests/blobs/test_xml_injection.py: an adversarial guard that renders
each blob type with injection payloads in its escapable fields and asserts
the output parses as well-formed XML, so a future emit site that bypasses
the helper is caught.

2185 of 2572 branches covered (84.95%)

Branch coverage included in aggregate %.

39 of 39 new or added lines in 4 files covered. (100.0%)

5769 of 6299 relevant lines covered (91.59%)

0.92 hits per line