Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions lib/filter_scene.py
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# -*- coding: UTF-8 -*-
# -*- coding: utf-8 -*-

# Version 3.1; Erik Husby, Ryan Shellberg; Polar Geospatial Center, University of Minnesota; 2019
# Translated from MATLAB code written by Ian Howat, Ohio State University, 2018
Expand Down Expand Up @@ -1882,7 +1882,10 @@ def readFromXml(xmlFile, xml_paramstrs):
while line != '' and None in values:
for ps in xml_paramstrs_left:
if ps in line:
values[xml_paramstrs.index(ps)] = line.replace("<{}>".format(ps), '').replace("</{}>".format(ps), '')
if not re.match(r"^[A-Za-z0-9-_\.]+$", ps):
raise InvalidArgumentError(f"Error: Illegal XML tag name: {ps}")
regex = "<([^:]*:){0,1}"+ps+">(.*)</([^:]*:){0,1}"+ps+">"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this should validate that ps doesn't have anything funky in it that could be interpreted as part of the regex instead of just a literal. In practice, ps is controlled by trusted code so it would be unlikely for it to contain something unexpected.

values[xml_paramstrs.index(ps)] = re.sub(regex, r"\2", line)
xml_paramstrs_left.remove(ps)
break
xmlFile_fp.close()
Expand Down