CVE-2024-3572: Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
value: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data. 
CWE description: The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Published: 2024-04-16T00:15Z
Repository: https://github.com/scrapy/scrapy
Language: Other
Files changed: docs/news.rst
Commit date: 2024-02-14 17:16:25 +0100
Commit message: Merge branch '2.11-compression-bomb' into 2.11

Diff: diff --cc docs/news.rst
index 5a3d5e783,a12bda53f..ad931d6db
--- a/docs/news.rst
+++ b/docs/news.rst
@@@ -6,74 -6,22 +6,84 @@@ Release note
  .. _release-2.11.1:
  
  Scrapy 2.11.1 (unreleased)
  --------------------------
  
 -**Security bug fix:**
 +Highlights:
 +
 +-   Security bug fixes.
 +
 +-   Support for Twisted >= 23.8.0.
 +
 +-   Documentation improvements.
 +
 +Security bug fixes
 +~~~~~~~~~~~~~~~~~~
  
+ -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
+     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
+     advisory`_ for more information.
+ 
+     .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
+ 
+ -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, the
+     deprecated ``scrapy.downloadermiddlewares.decompression`` module has been
+     removed.
+ 
 +-   The ``Authorization`` header is now dropped on redirects to a different
 +    domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
 +    information.
 +
 +    .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
 +
 +Modified requirements
 +~~~~~~~~~~~~~~~~~~~~~
 +
 +-   The Twisted dependency is no longer restricted to < 23.8.0. (:issue:`6024`,
 +    :issue:`6064`, :issue:`6142`)
 +
 +Bug fixes
 +~~~~~~~~~
 +
 +-   The OS signal handling code was refactored to no longer use private Twisted
 +    functions. (:issue:`6024`, :issue:`6064`, :issue:`6112`)
 +
 +Documentation
 +~~~~~~~~~~~~~
 +
 +-   Improved documentation for :class:`~scrapy.crawler.Crawler` initialization
 +    changes made in the 2.11.0 release. (:issue:`6057`, :issue:`6147`)
 +
 +-   Extended documentation for :attr:`Request.meta <scrapy.http.Request.meta>`.
 +    (:issue:`5565`)
 +
 +-   Fixed the :reqmeta:`dont_merge_cookies` documentation. (:issue:`5936`,
 +    :issue:`6077`)
 +
 +-   Added a link to Zyte's export guides to the :ref:`feed exports
 +    <topics-feed-exports>` documentation. (:issue:`6183`)
 +
 +-   Added a missing note about backward-incompatible changes in
 +    :class:`~scrapy.exporters.PythonItemExporter` to the 2.11.0 release notes.
 +    (:issue:`6060`, :issue:`6081`)
 +
 +-   Added a missing note about removing the deprecated
 +    ``scrapy.utils.boto.is_botocore()`` function to the 2.8.0 release notes.
 +    (:issue:`6056`, :issue:`6061`)
 +
 +-   Other documentation improvements. (:issue:`6128`, :issue:`6144`,
 +    :issue:`6163`, :issue:`6190`, :issue:`6192`)
 +
 +Quality assurance
 +~~~~~~~~~~~~~~~~~
 +
 +-   Added Python 3.12 to the CI configuration, re-enabled tests that were
 +    disabled when the pre-release support was added. (:issue:`5985`,
 +    :issue:`6083`, :issue:`6098`)
 +
 +-   Fixed a test issue on PyPy 7.3.14. (:issue:`6204`, :issue:`6205`)
 +
  
  .. _release-2.11.0:
  
  Scrapy 2.11.0 (2023-09-18)
  --------------------------
@@@ -2939,23 -2887,25 +2949,32 @@@ affect subclasses
      corresponding instances of
      :attr:`~scrapy.core.scheduler.DownloaderAwarePriorityQueue.downstream_queue_cls`.
  
  (:issue:`3884`)
  
++
  .. _release-1.8.4:
  
  Scrapy 1.8.4 (unreleased)
  -------------------------
  
 -**Security bug fix:**
 +**Security bug fixes:**
  
+ -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
+     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
+     advisory`_ for more information.
+ 
+ -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the
+     ``scrapy.downloadermiddlewares.decompression`` module is discouraged and
+     will trigger a warning.
+ 
 +-   The ``Authorization`` header is now dropped on redirects to a different
 +    domain. Please, see the `cw9j-q3vf-hrrv security advisory`_ for more
 +    information.
 +
 +    .. _cw9j-q3vf-hrrv security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-cw9j-q3vf-hrrv
 +
  
  .. _release-1.8.3:
  
  Scrapy 1.8.3 (2022-07-25)
  -------------------------

Fixed code:  -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
     advisory`_ for more information.
 
     .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
 
 -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, the
     deprecated ``scrapy.downloadermiddlewares.decompression`` module has been
     removed.
 
+
 -   :setting:`DOWNLOAD_MAXSIZE` and :setting:`DOWNLOAD_WARNSIZE` now also apply
     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
     advisory`_ for more information.
 
 -   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the
     ``scrapy.downloadermiddlewares.decompression`` module is discouraged and
     will trigger a warning.