From ad6f876f40ff197f0f117f5f52a0fd1aa3289288 Mon Sep 17 00:00:00 2001
From: pax <paxxe@protonmail.com>
Date: Sun, 12 Apr 2026 14:55:30 -0500
Subject: [PATCH] category_fetcher: reject XML responses with DOCTYPE/ENTITY
 declarations

User-configurable sites could send XXE or billion-laughs payloads
via tag category API responses. Reject any XML body containing
<!DOCTYPE or <!ENTITY before passing to ET.fromstring.
---
 booru_viewer/core/api/category_fetcher.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/booru_viewer/core/api/category_fetcher.py b/booru_viewer/core/api/category_fetcher.py
index 832b5e0..e625e1f 100644
--- a/booru_viewer/core/api/category_fetcher.py
+++ b/booru_viewer/core/api/category_fetcher.py
@@ -593,6 +593,9 @@ def _parse_tag_response(resp) -> list[tuple[str, int]]:
         return []
     out: list[tuple[str, int]] = []
     if body.startswith("<"):
+        if "<!DOCTYPE" in body or "<!ENTITY" in body:
+            log.warning("XML response contains DOCTYPE/ENTITY, skipping")
+            return []
         try:
             root = ET.fromstring(body)
         except ET.ParseError as e: