Mailing List Archive

I´ve been playing with the XML output format for nessus 1.2.5
I´ve read on the archives of the nessus lists that there have been some
problems in the past with some characters escaping (< for example).
I can see on xml_output_ng.c that there's a escape_string function that
solves the problem.
The problem I found is that this function is called from function
xml_fprintf_element but it's not called from xml_fprintf.
In practice, I noticed that, with a default config, in the <plugins>
section appears:

<setting name="Misc information on News server[entry]:From address :"
value="Nessus <listme@listme.dsbl.org>"/>

which is not valid XML (<listme should be replaced by &lt;listme). This
is because this part of the XML is written using xml_fprintf.

I managed to patch this c file in order to avoid this particular
problem, but it´s not a general solution (I think xml_fprintf should be
rewritten, but I don´t undestand fully how it works).
I´m sending my diff file, but I think another (more general) workaround
should be implemented.
Btw, my solution is not complete, it only escapes the settings part of
the XML.

Hope this helps,

Rodolfo



*** xml_output_ng.c.ori Tue Sep 3 11:20:16 2002
--- xml_output_ng.c Tue Sep 3 11:23:58 2002
***************
*** 335,349 ****
static void
xml_config_plugins (FILE* fd, int indent, struct arglist* t)
{
xml_fprintf (fd, indent, "<plugins>\n");
while( t->next )
{
if(strcmp(t->name, "plugin_set"))
{
if (t->type == ARG_STRING)
! xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n", t->name, (char *) t->value);
else if (t->type == ARG_INT)
xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n ", t->name, (t->value?"yes":"no"));
}
t = t->next;
}
--- 335,352 ----
static void
xml_config_plugins (FILE* fd, int indent, struct arglist* t)
{
+ char *escstr = NULL;
xml_fprintf (fd, indent, "<plugins>\n");
while( t->next )
{
if(strcmp(t->name, "plugin_set"))
{
+ escstr = escape_string(t->value);
if (t->type == ARG_STRING)
! xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n", t->name, (char *) escstr);
else if (t->type == ARG_INT)
xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n ", t->name, (t->value?"yes":"no"));
+ efree(&escstr);
}
t = t->next;
}
***************
*** 353,365 ****
static void
xml_config_server (FILE* fd, int indent, struct arglist* t)
{
xml_fprintf (fd, indent, "<server>\n");
while( t->next )
{
if (t->type == ARG_STRING)
! xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n", t->name, (char *) t->value);
else if (t->type == ARG_INT)
xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n ", t->name, (t->value?"yes":"no"));
t = t->next;
}
xml_fprintf (fd, indent, "</server>\n\n");
--- 356,371 ----
static void
xml_config_server (FILE* fd, int indent, struct arglist* t)
{
+ char *escstr = NULL;
xml_fprintf (fd, indent, "<server>\n");
while( t->next )
{
+ escstr = escape_string(t->value);
if (t->type == ARG_STRING)
! xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n", t->name, (char *) escstr);
else if (t->type == ARG_INT)
xml_fprintf (fd, indent+1, "<setting name=\"%s\" value=\"%s\"/>\n ", t->name, (t->value?"yes":"no"));
+ efree(&escstr);
t = t->next;
}
xml_fprintf (fd, indent, "</server>\n\n");