Views
No views yet
modelaudit scan bypass.xml -> detect_file_format 'unknown', NO scanner selected -> Clean / exit 0, even though the file carries a live XXE DOCTYPE (<!ENTITY xxe SYSTEM ...>). The byte-IDENTICAL bypass_named.pmml (only the extension differs) -> PmmlScanner -> 2x CRITICAL 'XXE Attack Vector Check' / exit 1 (positive control by extension). control.xml (same XXE, WITHOUT the inert <!-- ] --> comment) -> detect 'pmml' -> CRITICAL / exit 1 (positive control by content). benign.pmml -> Clean (true-negative)..xml, same live XXE payload, differ only by one inert DTD comment -> CRITICAL vs Clean; (2) bypass.xml vs bypass_named.pmml = byte-identical (sha256 9075c5de...), differ only by extension -> Clean vs CRITICAL. Liveness: lxml (resolve_entities=True, load_dtd=True, no_network=True) expands the external entity in BOTH control and bypass, leaking the benign lab marker into <Timestamp> text -> the bypass is a genuinely dangerous model, not merely malformed._skip_xml_doctype_declaration tracks only [/] bracket depth + quotes and does NOT skip XML comments inside the DTD internal subset. A comment containing ] (<!-- ] -->) decrements bracket_depth to 0, so the next > (end of -->) is mistaken for the DOCTYPE terminator; _xml_root_tag_from_prefix (578-626) then resumes mid-DTD at <!ENTITY, hits the <! guard (:614), returns root_tag=None -> _detect_xml_model_format returns 'unknown' (:635) -> no scanner. The live XXE detector pmml_scanner.py:238-261 _check_dangerous_xml_constructs is therefore never invoked. modelscan 0.8.8 has no PMML scanner (N/A)..xml extension and modelaudit ships CONTENT-based PMML detection precisely for that case, so defeating the content route is a real scanner defect (CWE-436 parser-differential routing enabling CWE-611 XXE), not an out-of-scope rename.