From dadc804567a51f803cd6715f7885c11a247915f6 Mon Sep 17 00:00:00 2001 From: dgtlmoon Date: Thu, 26 Mar 2026 09:43:03 +0100 Subject: [PATCH] Security: XPath json-doc() Arbitrary File Read Bypass ( Similar fix as CVE-2026-29039 ) --- changedetectionio/html_tools.py | 6 ++++++ changedetectionio/tests/test_xpath_selector.py | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/changedetectionio/html_tools.py b/changedetectionio/html_tools.py index 500df0c98..f029ad7a3 100644 --- a/changedetectionio/html_tools.py +++ b/changedetectionio/html_tools.py @@ -70,6 +70,12 @@ _DEFAULT_UNSAFE_XPATH3_FUNCTIONS = [ 'unparsed-text-available', 'doc', 'doc-available', + 'json-doc', + 'json-doc-available', + 'collection', # XPath 2.0+: loads XML node collections from arbitrary URIs + 'uri-collection', # XPath 3.0+: enumerates URIs from resource collections + 'transform', # XPath 3.1: XSLT transformation (currently raises, block proactively) + 'load-xquery-module', # XPath 3.1: loads XQuery modules (currently raises, block proactively) 'environment-variable', 'available-environment-variables', ] diff --git a/changedetectionio/tests/test_xpath_selector.py b/changedetectionio/tests/test_xpath_selector.py index 1e4e601c6..88ce48f0e 100644 --- a/changedetectionio/tests/test_xpath_selector.py +++ b/changedetectionio/tests/test_xpath_selector.py @@ -610,6 +610,11 @@ def test_xpath_blocked_functions_unit(): "unparsed-text-available('file:///etc/passwd')", "doc('file:///etc/passwd')", "doc-available('file:///etc/passwd')", + "json-doc('file:///datastore/changedetection.json')", + "collection('file:///datastore/')", + "uri-collection('file:///datastore/')", + "transform(map{})", + "load-xquery-module('foo')", "environment-variable('PATH')", "available-environment-variables()", ]