initial public release

internal/scan/xml_safe.go

@@ -0,0 +1,15 @@
+package scan
+
+import (
+	"encoding/xml"
+	"io"
+)
+
+// newSafeXMLDecoder disables external entity expansion so parseRSSItems is
+// XXE-safe even when a malicious feed is served.
+func newSafeXMLDecoder(r io.Reader) *xml.Decoder {
+	d := xml.NewDecoder(r)
+	d.Strict = false
+	d.Entity = map[string]string{} // no external/named entity resolution
+	return d
+}