4 ms·
From the author themselves, 6 years ago: > defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion. ht
by slau 2y ago
From the author themselves, 6 years ago:
> defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion.
https://github.com/tiran/defusedxml/issues/25#issuecomment-422436105 https://github.com/tiran/defusedxml/issues/25#issuecomment-4...
- masklinn 2y agoNote that this is not enabled by default, although there is an upper bound on tree size which does limit the reach of the issue. See https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs for more about the tuning knobs.
- JonChesterfield 2y agolibxml2 segfaults on me whenever I give it vaguely complicated xsl templates so I'm doubtful about how effective that handling will be.
- metafunctor 2y agoOK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.