5 ms·
DefusedXML is an amazing piece of code. This being said, many of the mitigations it enables are now also available by default in many “standard” libraries. For
by slau 2y ago
DefusedXML is an amazing piece of code.
This being said, many of the mitigations it enables are now also available by default in many “standard” libraries. For example, bandit will often tell you to not use lxml in Python, but instead use defusedxml. However, modern versions don’t suffer the same issues at all, and this is a case where automatically following the advice of the linter/SCA is not a great idea.
- metafunctor 2y agoDo you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?
- slau 2y agoFrom the author themselves, 6 years ago: > defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion. https://github.com/tiran/defusedxml/issues/25#issuecomment-422436105 https://github.com/tiran/defusedxml/issues/25#issuecomment-4...
- masklinn 2y agoNote that this is not enabled by default, although there is an upper bound on tree size which does limit the reach of the issue. See https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs for more about the tuning knobs.
- JonChesterfield 2y agolibxml2 segfaults on me whenever I give it vaguely complicated xsl templates so I'm doubtful about how effective that handling will be.
- metafunctor 2y agoOK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.
- masklinn 2y agoIf you’re trying to use it for lxml then yes, it was only ever experimental and has been deprecated (it also failed to define some interfaces correctly causing issues). If you’re using it over the stdlib then no.