Unsafe XML parser used

[rashmibhanu]

Sxd-document security issues
In order to parse XML, MathCat uses sxd-document and sxd-xpath. These libraries Contain significant amounts of unsafe code.
Parser replacement will make these libraries safe.

[NSoiffer]

In case you weren't aware, there is only one place that calls the parser. It would be easy to swap that out but the rest of the code extensively (maybe one in every 4 - 10 lines of code) makes use of the DOM. The entire rule-based system depends upon xpath functionality. So any replacement needs to support those functionalities.

There is highly regarded parser (based on number of downloads) called roxmltree, but AFAIK, no xpath library (of which there are only few in Rust) works with it. AFAIK, there are only two xpath libraries that allow function definitions (which is essential for MathCAT to add useful functionality to the MathCAT rules): sxd-xpath and xee-xpath. xee-xpath doesn't allow for DOM manipulation. That means the only viable libraries to use are sxd-document and sxd-xpath -- these are designed to work together.

So I think the way forward is to fix whatever security issues there are in sxd-document and sxd-xpath. I can clone them and use a fixed version in MathCAT, but it would benefit everyone to make the fixes in the main repo. I did a web search to try and see if anyone has reported a security problem with sxd-document. The only one I found was the one you earlier mentioned that was fixed in 2017. So no reported security issues in the 9 years since. I'm not a security expert, but since you feel there is unsafe code that can be exploited, then I believe the proper thing to do is to report it privately to the developer. Have you done that? If you don't want to do that and if I fork the project, can you (privately) let me know what the problem is so that I can fix it?

FYI: sxd-document and sxd-xpath have 1.7 and 1.2 million downloads, with over a quarter of a million downloads in the last 90 days. They have been around for years, so there seems to be lots of users. It is one of the reasons I felt good about using those libraries as opposed to trying to build some parts of them from scratch. Up until you found something wrong with them, I've not had any doubts about their reliability. I hope we can work together fix up what you found.