3 ms·

From what I can tell, it is very well known in security circles. Even so, we as a team of 8 didn't catch the problem for some time because we weren't aware of

• dalke 12y ago
  While I have little experience with it, I know the goal of the defusedxml package (see https://pypi.python.org/pypi/defusedxml https://pypi.python.org/pypi/defusedxml ) is to make it so that teams like yours can worry less about these details. It has a module which "acts as an example how you could protect code that uses lxml.etree. It implements a custom Element class that filters out Entity instances, a custom parser factory and a thread local storage for parser instances. It also has a check_docinfo() function which inspects a tree for internal or external DTDs and entity declarations." It sounds like it would have defused your example of lxml, and perhaps a few others you haven't considered.
  • fryguy 12y ago
    But how do you know to use defusedxml instead of the regular one? I've never even heard of it.
    • dalke 12y ago
      The base problem is that XML is not secure by default. Every solution requires either figuring out the problems yourself (which is impossible, given the number of problems that exist), or learning about it from elsewhere. No matter what, there will be people asking the same question you did. I found out about defusedxml because I read planet.python.org where http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html http://blog.python.org/2013/02/announcing-defusedxml-fixes-f... came up, and because I had enough general understanding of the security problems with XML to recognize why it was created.