From d83e426fff3f6d0fa6042d0930fb70357db24125 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@gnome.org>
Date: Mon, 11 Feb 2013 21:36:30 +0000
Subject: io: Use XML_PARSE_NONET

We don't want to load resources off the net.

Bug #691708.
---
Index: librsvg-2.36.1/rsvg-base.c
===================================================================
--- librsvg-2.36.1.orig/rsvg-base.c	2013-11-26 16:07:25.021364586 +0100
+++ librsvg-2.36.1/rsvg-base.c	2013-11-26 16:07:25.037364682 +0100
@@ -573,6 +573,7 @@ rsvg_start_xinclude (RsvgHandle * ctx, R
             goto fallback;
 
         xml_parser = xmlCreatePushParserCtxt (&rsvgSAXHandlerStruct, ctx, NULL, 0, NULL);
+        xml_parser->options |= XML_PARSE_NONET;
 
         buffer = _rsvg_xml_input_buffer_new_from_stream (stream, NULL /* cancellable */, XML_CHAR_ENCODING_NONE, &err);
         g_object_unref (stream);
@@ -1112,6 +1113,7 @@ rsvg_handle_write_impl (RsvgHandle * han
     if (handle->priv->ctxt == NULL) {
         handle->priv->ctxt = xmlCreatePushParserCtxt (&rsvgSAXHandlerStruct, handle, NULL, 0,
                                                       rsvg_handle_get_base_uri (handle));
+        handle->priv->ctxt->options |= XML_PARSE_NONET;
 
         /* if false, external entities work, but internal ones don't. if true, internal entities
            work, but external ones don't. favor internal entities, in order to not cause a
@@ -1768,6 +1770,7 @@ rsvg_handle_read_stream_sync (RsvgHandle
     if (priv->ctxt == NULL) {
         priv->ctxt = xmlCreatePushParserCtxt (&rsvgSAXHandlerStruct, handle, NULL, 0,
                                               rsvg_handle_get_base_uri (handle));
+        priv->ctxt->options |= XML_PARSE_NONET;
 
         /* if false, external entities work, but internal ones don't. if true, internal entities
            work, but external ones don't. favor internal entities, in order to not cause a
Index: librsvg-2.36.1/rsvg-css.c
===================================================================
--- librsvg-2.36.1.orig/rsvg-css.c	2012-03-26 14:25:11.000000000 +0200
+++ librsvg-2.36.1/rsvg-css.c	2013-11-26 16:07:25.041364707 +0100
@@ -830,6 +830,8 @@ rsvg_css_parse_xml_attribute_string (con
     xmlSAX2InitDefaultSAXHandler (&handler, 0);
     handler.serror = rsvg_xml_noerror;
     parser = xmlCreatePushParserCtxt (&handler, NULL, tag, strlen (tag) + 1, NULL);
+    parser->options |= XML_PARSE_NONET;
+
     if (xmlParseDocument (parser) != 0)
         goto done;
 
