GHSA-cfmv-h8fx-85m7: xml2rfc has an arbitrary file read vulnerability

The vulnerability lies in the processing of <link rel="attachment"> elements in the input XML, which can be abused to read arbitrary files from the local filesystem. The security patch addresses this by introducing a new function, xml2rfc.utils.strip_link_attachments, which explicitly removes these elements from the XML tree.

The patch applies this fix by calling strip_link_attachments within the validate method of the BaseV3Writer class. This indicates that BaseV3Writer.validate is the function that is called early in the processing pipeline and is responsible for ensuring the input is safe. By adding the sanitization step here, the developers have patched the vulnerability before the malicious data can be used by any downstream function that performs the file access. Therefore, BaseV3Writer.validate is the key function that would be observed in a runtime profile when the vulnerability is triggered.