Commit 4f8aa579ce for asterisk.org

commit 4f8aa579cef907569f5c9dd8c7332844577ae756
Author: George Joseph <gjoseph@sangoma.com>
Date:   Thu Jan 15 08:38:26 2026 -0700

    xml.c: Replace XML_PARSE_NOENT with XML_PARSE_NONET for xmlReadFile.

    The xmlReadFile XML_PARSE_NOENT flag, which allows parsing of external
    entities, could allow a potential XXE injection attack.  Replacing it with
    XML_PARSE_NONET, which prevents network access, is safer.

    Resolves: #GHSA-85x7-54wr-vh42

diff --git a/main/xml.c b/main/xml.c
index 8f7a891116..c3182aa4dc 100644
--- a/main/xml.c
+++ b/main/xml.c
@@ -99,7 +99,7 @@ struct ast_xml_doc *ast_xml_open(char *filename)
 		return NULL;
 	}

-	doc = xmlReadFile(filename, NULL, XML_PARSE_RECOVER | XML_PARSE_NOENT);
+	doc = xmlReadFile(filename, NULL, XML_PARSE_RECOVER | XML_PARSE_NONET);
 	if (!doc) {
 		return NULL;
 	}
@@ -503,7 +503,7 @@ struct ast_xslt_doc *ast_xslt_open(char *filename)
 	xsltStylesheet *xslt;
 	xmlDoc *xml;

-	xml = xmlReadFile(filename, NULL, XML_PARSE_RECOVER | XML_PARSE_NOENT);
+	xml = xmlReadFile(filename, NULL, XML_PARSE_RECOVER | XML_PARSE_NONET);
 	if (!xml) {
 		return NULL;
 	}
@@ -531,7 +531,7 @@ struct ast_xslt_doc *ast_xslt_read_memory(char *buffer, size_t size)
 		return NULL;
 	}

-	doc = xmlReadMemory(buffer, (int) size, NULL, NULL, XML_PARSE_RECOVER | XML_PARSE_NOENT);
+	doc = xmlReadMemory(buffer, (int) size, NULL, NULL, XML_PARSE_RECOVER | XML_PARSE_NONET);
 	if (!doc) {
 		return NULL;
 	}