From 4b8269ea377288af071bdacf66124ca0ea5b636c Mon Sep 17 00:00:00 2001
From: Rene Krenn <rkrenn@sipwise.com>
Date: Fri, 16 Jan 2026 12:28:19 +0100
Subject: [PATCH] MT#62342 encode XMLRPC request body, decode XMLRPC response
 body

prevent api 500 errors ie. from LibXML parsing because of
invalid chars.

Change-Id: I2630ba285e1da7bcbfe5558bad1b7c30fa86bebe
(cherry picked from commit 14caac386c236c2981e746b161f5fdd126a8cc77)
(cherry picked from commit 936a944a541030e7e77cc1a2b196c0db48291a7e)
---
 lib/NGCP/Panel/Utils/HTTPDispatcher.pm | 11 ++++++++++-
 lib/NGCP/Panel/Utils/Security.pm       |  4 +++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/NGCP/Panel/Utils/HTTPDispatcher.pm b/lib/NGCP/Panel/Utils/HTTPDispatcher.pm
index f59654d871..97a6f9af1f 100644
--- a/lib/NGCP/Panel/Utils/HTTPDispatcher.pm
+++ b/lib/NGCP/Panel/Utils/HTTPDispatcher.pm
@@ -3,6 +3,7 @@ package NGCP::Panel::Utils::HTTPDispatcher;
 use Sipwise::Base;
 use Net::HTTP;
 use Errno;
+use Encode qw/encode_utf8 decode_utf8/;
 
 sub dispatch {
     my ($c, $target, $all, $sync, $method, $content_type, $body, $schema) = @_;
@@ -40,7 +41,7 @@ sub dispatch {
                 return [$hostid, -1, '']; # skip the host as it is not active
             };
 
-            my $res = $s->write_request($method, $path || "/", "User-Agent" => "Sipwise HTTP Dispatcher", "Content-Type" => $content_type, $body);
+            my $res = $s->write_request($method, $path || "/", "User-Agent" => "Sipwise HTTP Dispatcher", "Content-Type" => $content_type, encode_utf8($body));
             $res or die "did not get result";
 
             my ($code, $mess, @headers) = $s->read_response_headers();
@@ -61,6 +62,14 @@ sub dispatch {
 
             # successful request
 
+            eval {
+                $body = decode_utf8($body, Encode::FB_CROAK);
+            };
+            if ($@) {
+                # If strict UTF-8 decoding fails, use lenient decoding
+                $body = decode_utf8($body, Encode::FB_QUIET);
+            }
+
             return [$hostid, 1, $body]; # return from eval only
         };
 
diff --git a/lib/NGCP/Panel/Utils/Security.pm b/lib/NGCP/Panel/Utils/Security.pm
index 35da809ad1..b403e3e513 100644
--- a/lib/NGCP/Panel/Utils/Security.pm
+++ b/lib/NGCP/Panel/Utils/Security.pm
@@ -60,7 +60,9 @@ EOF
     my @users = ();
     my $usr = {};
     for my $host (grep {$$_[1]} @$user_res) {
-        my $xmlDoc = $xml_parser->parse_string($host->[2]);
+        my $xml = $host->[2];
+        $xml =~ s/[\x00-\x08\x0b\x0c\x0e-\x1f]//g;
+        my $xmlDoc = $xml_parser->parse_string($xml);
         my $username = '';
         my $key = '';
         foreach my $node ($xmlDoc->findnodes('//member')) {