From f59af9cb2a6419f234d87c63aff2b45719f4067e Mon Sep 17 00:00:00 2001
From: Nick Sweeting <git@sweeting.me>
Date: Mon, 8 Jun 2026 23:32:52 -0700
Subject: [PATCH] Cover malicious feed add input

---
 archivebox/tests/test_cli_add.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/archivebox/tests/test_cli_add.py b/archivebox/tests/test_cli_add.py
index c0b3ed85..658e3974 100644
--- a/archivebox/tests/test_cli_add.py
+++ b/archivebox/tests/test_cli_add.py
@@ -208,6 +208,16 @@ def malicious_add_inputs(tmp_path: Path, *, safe_url: str) -> tuple[list[str], P
             f'" && touch {canary} && echo "',
             f"$(touch {canary})",
             f"`touch {canary}`",
+            """<?xml version="1.0"?>
+<!DOCTYPE rss [
+  <!ENTITY localfile SYSTEM "file:///etc/hosts">
+]>
+<rss version="2.0" xmlns:xi="http://www.w3.org/2001/XInclude">
+  <channel>
+    <item><title>&localfile;</title><link>file:///etc/passwd</link></item>
+    <xi:include href="file:///etc/hosts" parse="text"/>
+  </channel>
+</rss>""",
         ],
         canary,
     )