defusedxml · pypi · 2019-09-16 · synopsis the results of an ... long time with a small to...

8/5/2019 defusedxml · PyPI

https://pypi.org/project/defusedxml/0.5.0/ 1/24

Navigation

� Projectdescription

ś Releasehistory

Ñ Downloadfiles

Projectlinks

ŝ Homepage

� Download

Statistics

Projectdescription

“It’sjustXML,whatcouldprobablygowrong?”

ChristianHeimes<christian@python.org >

Synopsis

TheresultsofanattackonavulnerableXMLlibrarycanbefairlydramatic.WithjustafewhundredBytesofXMLdataanattackercanoccupyseveralGigabytesofmemorywithinseconds.AnattackercanalsokeepCPUsbusyforalongtimewithasmalltomediumsizerequest.Undersomecircumstancesitisevenpossibletoaccesslocalfilesonyourserver,tocircumventafirewall,ortoabuseservicestoreboundattackstothirdparties.

TheattacksuseandabuselesscommonfeaturesofXMLanditsparsers.Themajorityofdevelopersareunacquaintedwithfeatures

Help Donate Login Register

pipinstalldefusedxml==0.5.0

defusedxml0.5.0 âNewerversionavailable(0.6.0)

Lastreleased:Feb9,2017

XMLbombprotectionforPythonstdlibmodules

Searchprojects ȡ

GitHubstatistics:

ɕ Stars:126

� Forks:25

á Openissues/PRs:8

ViewstatisticsforthisprojectviaLibraries.io ,orbyusingGoogleBigQuery

License:PythonSo�wareFoundationLicense(PSFL)

Author:ChristianHeimes

ɶxml,bomb,DoS

Maintainers

Classifiers

DevelopmentStatus5-Production/Stable

IntendedAudienceDevelopers

LicenseOSIApproved::PythonSo�ware

suchasprocessinginstructionsandentityexpansionsthatXMLinheritedfromSGML.Atbesttheyknowabout <!DOCTYPE> fromexperiencewithHTMLbuttheyarenotawarethatadocumenttypedefinition(DTD)cangenerateanHTTPrequestorloadafilefromthefilesystem.

Noneoftheissuesisnew.Theyhavebeenknownforalongtime.Billionlaughswasfirstreportedin2003.NeverthelesssomeXMLlibrariesandapplicationsarestillvulnerableandevenheavyusersofXMLaresurprisedbythesefeatures.It’shardtosaywhomtoblameforthesituation.It’stooshortsightedtoshi�allblameonXMLparsersandXMLlibrariesforusinginsecuredefaultsettings.A�eralltheyproperlyimplementXMLspecifications.Applicationdevelopersmustnotrelythatalibraryisalwaysconfiguredforsecurityandpotentialharmfuldatabydefault.

TableofContents

Synopsis

Attackvectors

billionlaughs/exponentialentityexpansion

quadraticblowupentityexpansion

externalentityexpansion(remote)

externalentityexpansion(localfile)

DTDretrieval

PythonXMLLibraries

Settingsinstandardlibrary

defusedxml

defusedxml(package)

defusedxml.cElementTree

defusedxml.ElementTree

defusedxml.expatreader

defusedxml.sax

defusedxml.expatbuilder

defusedxml.minidom

defusedxml.pulldom

defusedxml.xmlrpc

FoundationLicense

NaturalLanguageEnglish

ProgrammingLanguagePythonPython::2Python::2.7Python::3Python::3.4Python::3.5Python::3.6

TopicTextProcessing::Markup::XML

defusedxml.lxml

defusedexpat

Modificationsinexpat

HowtoavoidXMLvulnerabilities

Otherthingstoconsider

attributeblowup/hashcollisionattack

decompressionbomb

ProcessingInstruction

OtherDTDfeatures

XPathinjectionattacks

XInclude

XMLSchemalocation

XSLTransformation

RelatedCVEs

Otherlanguages/frameworks

C#/.NET/Mono

License

Acknowledgements

References

Changelog

defusedxml0.5.0

defusedxml0.5.0.rc1

defusedxml0.4.1

defusedxml0.4

defusedxml0.3

defusedxml0.2

defusedxml0.1

Attackvectors

billionlaughs/exponentialentityexpansion

TheBillionLaughsattack–alsoknownasexponentialentityexpansion–usesmultiplelevelsofnestedentities.Theoriginalexampleuses9levelsof10expansionsineachleveltoexpandthestring lol toastringof3*10 bytes,hencethename“billionlaughs”.Theresultingstringoccupies3GB(2.79GiB)ofmemory;intermediatestringsrequireadditionalmemory.Becausemostparsersdon’tcachetheintermediatestepforeveryexpansionitisrepeatedoverandoveragain.ItincreasestheCPUloadevenmore.

AnXMLdocumentofjustafewhundredbytescandisruptallservicesonamachinewithinseconds.

ExampleXML:

<!DOCTYPExmlbomb[<!ENTITYa"1234567890"><!ENTITYb"&a;&a;&a;&a;&a;&a;&a;&a;"><!ENTITYc"&b;&b;&b;&b;&b;&b;&b;&b;"><!ENTITYd"&c;&c;&c;&c;&c;&c;&c;&c;">]><bomb>&d;</bomb>

quadraticblowupentityexpansion

AquadraticblowupattackissimilartoaBillionLaughsattack;itabusesentityexpansion,too.Insteadofnestedentitiesitrepeatsonelargeentitywithacoupleofthousandcharsoverandoveragain.Theattackisn’tase�icientastheexponentialcasebutitavoidstriggeringcountermeasuresofparsersagainstheavilynestedentities.SomeparserslimitthedepthandbreadthofasingleentitybutnotthetotalamountofexpandedtextthroughoutanentireXMLdocument.

Amedium-sizedXMLdocumentwithacoupleofhundredkilobytescanrequireacoupleofhundredMBtoseveralGBofmemory.Whentheattackiscombinedwithsomelevelofnestedexpansionanattackerisabletoachieveahigherratioofsuccess.

Entitydeclarationscancontainmorethanjusttextforreplacement.Theycanalsopointtoexternalresourcesbypublicidentifiersorsystemidentifiers.SystemidentifiersarestandardURIs.WhentheURIisaURL(e.g.a http:// locator)someparsersdownloadtheresourcefromtheremotelocationandembedthemintotheXMLdocumentverbatim.

Simpleexampleofaparsedexternalentity:

ThecaseofparsedexternalentitiesworksonlyforvalidXMLcontent.TheXMLstandardalsosupportsunparsedexternalentitieswitha NDatadeclaration .

Externalentityexpansionopensthedoortoplentyofexploits.AnattackercanabuseavulnerableXMLlibraryandapplicationtoreboundandforwardnetworkrequestswiththeIPaddressoftheserver.Ithighlydependsontheparserandtheapplicationwhatkindofexploitispossible.Forexample:

Anattackercancircumventfirewallsandgainaccesstorestrictedresourcesasalltherequestsaremadefroman

<!DOCTYPEbomb[<!ENTITYa"xxxxxxx...acoupleoftenthousandchars]><bomb>&a;&a;&a;...repeat</bomb>

<!DOCTYPEexternal[<!ENTITYeeSYSTEM"http://www.python.org/some.xml">]><root>&ee;</root>

internalandtrustworthyIPaddress,notfromtheoutside.

Anattackercanabuseaservicetoattack,spyonorDoSyourserversbutalsothirdpartyservices.TheattackisdisguisedwiththeIPaddressoftheserverandtheattackerisabletoutilizethehighbandwidthofabigmachine.

Anattackercanexhaustadditionalresourcesonthemachine,e.g.withrequeststoaservicethatdoesn’trespondorrespondswithverylargefiles.

Anattackermaygainknowledge,when,howo�enandfromwhichIPaddressaXMLdocumentisaccessed.

AnattackercouldsendmailfrominsideyournetworkiftheURLhandlersupports smtp:// URIs.

Externalentitieswithreferencestolocalfilesareasub-caseofexternalentityexpansion.It’slistedasanextraattackbecauseitdeservesextraattention.SomeXMLlibrariessuchaslxmldisablenetworkaccessbydefaultbutstillallowentityexpansionwithlocalfileaccessbydefault.Localfilesareeitherreferencedwithafile:// URLorbyafilepath(eitherrelativeorabsolute).

Anattackermaybeabletoaccessanddownloadallfilesthatcanbereadbytheapplicationprocess.Thismayincludecriticalconfigurationfiles,too.

<!DOCTYPEexternal[<!ENTITYeeSYSTEM"file:///PATH/TO/simple.xml">]><root>&ee;</root>

DTDretrieval

Thiscaseissimilartoexternalentityexpansion,too.SomeXMLlibrarieslikePython’sxml.dom.pulldomretrievedocumenttypedefinitionsfromremoteorlocallocations.Severalattackscenariosfromtheexternalentitycaseapplytothisissueaswell.

PythonXMLLibraries

vulnerabilitiesandfeatures

kind sax etree minidom pulldom xmlrpc lxml genshi

billionlaughs

True True True True TrueFalse(1)

False(5)

quadraticblowup

True True True True True TrueFalse(5)

TrueFalse(3)

False(4) True falseFalse(1)

False(5)

TrueFalse(3)

False(4) True false TrueFalse(5)

DTDretrieval

True False False True falseFalse(1)

gzipbomb

False False False False Truepartly(2)

xpathsupport(7)

False False False False False True False

xsl(t)support(7)

False False False False False True False

<?xmlversion="1.0"encoding="utf-8"?><!DOCTYPEhtmlPUBLIC"-//W3C//DTDXHTML1.0Transitio"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitiona<html><head/><body>text</body></html>

kind sax etree minidom pulldom xmlrpc lxml genshi

xincludesupport(7)

FalseTrue(6)

False False FalseTrue(6)

Clibrary expat expat expat expat expat libxml2 expat

1.Lxmlisprotectedagainstbillionlaughsattacksanddoesn’tdonetworklookupsbydefault.

2.libxml2andlxmlarenotdirectlyvulnerabletogzipdecompressionbombsbuttheydon’tprotectyouagainstthemeither.

3.xml.etreedoesn’texpandentitiesandraisesaParserErrorwhenanentityoccurs.

4.minidomdoesn’texpandentitiesandsimplyreturnstheunexpandedentityverbatim.

5.genshi.inputofgenshi0.6doesn’tsupportentityexpansionandraisesaParserErrorwhenanentityoccurs.

6.Libraryhas(limited)XIncludesupportbutrequiresanadditionalsteptoprocessinclusion.

7.Thesearefeaturesbuttheymayintroduceexploitableholes,seeOtherthingstoconsider

Settingsinstandardlibrary

xml.sax.handlerFeatures

feature_external_ges(http://xml.org/sax/features/external-general-entities)

disablesexternalentityexpansion

feature_external_pes(http://xml.org/sax/features/external-parameter-entities)

theoptionisignoredanddoesn’tmodifyanyfunctionality

DOMxml.dom.xmlbuilder.Options

external_parameter_entities

ignored

external_general_entitiesignored

external_dtd_subsetignored

entitiesunsure

defusedxml

Thedefusedxmlpackage(defusedxmlonPyPI)containsseveralPython-onlyworkaroundsandfixesfordenialofserviceandothervulnerabilitiesinPython’sXMLlibraries.Inordertobenefitfromtheprotectionyoujusthavetoimportandusethelistedfunctions/classesfromtherightdefusedxmlmoduleinsteadoftheoriginalmodule.Merelydefusedxml.xmlrpcisimplementedasmonkeypatch.

Insteadof:

>>>fromxml.etree.ElementTreeimportparse>>>et=parse(xmlfile)

altercodeto:

>>>fromdefusedxml.ElementTreeimportparse>>>et=parse(xmlfile)

Additionallythepackagehasanuntestedfunctiontomonkeypatchallstdlibmoduleswith defusedxml.defuse_stdlib() .

Allfunctionsandparserclassesacceptthreeadditionalkeywordarguments.Theyreturneitherthesameobjectsastheoriginalfunctionsorcompatiblesubclasses.

forbid_dtd(default:False)

disallowXMLwitha <!DOCTYPE> processinginstructionandraiseaDTDForbiddenexceptionwhenaDTDprocessinginstructionisfound.

forbid_entities(default:True)disallowXMLwith <!ENTITY> declarationsinsidetheDTDandraiseanEntitiesForbiddenexceptionwhenanentityisdeclared.

forbid_external(default:True)disallowanyaccesstoremoteorlocalresourcesinexternalentitiesorDTDandraisinganExternalReferenceForbiddenexceptionwhenaDTDorentityreferencesanexternalresource.

defusedxml(package)

DefusedXmlException,DTDForbidden,EntitiesForbidden,ExternalReferenceForbidden,NotSupportedError

defuse_stdlib()(experimental)

defusedxml.cElementTree

parse(),iterparse(),fromstring(),XMLParser

defusedxml.ElementTree

parse(),iterparse(),fromstring(),XMLParser

defusedxml.expatreader

create_parser(),DefusedExpatParser

defusedxml.sax

parse(),parseString(),create_parser()

defusedxml.expatbuilder

parse(),parseString(),DefusedExpatBuilder,DefusedExpatBuilderNS

defusedxml.minidom

parse(),parseString()

defusedxml.pulldom

parse(),parseString()

defusedxml.xmlrpc

Thefixisimplementedasmonkeypatchforthestdlib’sxmlrpcpackage(3.x)orxmlrpclibmodule(2.x).Thefunctionmonkey_patch()enablesthefixes,unmonkey_patch()removesthepatchandputsthecodeinitsformerstate.

ThemonkeypatchprotectsagainstXMLrelatedattacksaswellasdecompressionbombsandexcessivelylargerequestsorresponses.Thedefaultsettingis30MBforrequests,responsesandgzipdecompression.YoucanmodifythedefaultbychangingthemodulevariableMAX_DATA.Avalueof-1disablesthelimit.

defusedxml.lxml

Themoduleactsasanexamplehowyoucouldprotectcodethatuseslxml.etree.ItimplementsacustomElementclassthatfiltersoutEntityinstances,acustomparserfactoryandathreadlocalstorageforparserinstances.Italsohasacheck_docinfo()functionwhichinspectsatreeforinternalorexternalDTDsandentitydeclarations.Inordertocheckforentitieslxml>3.0isrequired.

parse(),fromstring()RestrictedElement,GlobalParserTLS,getDefaultParser(),check_docinfo()

defusedexpat

Thedefusedexpatpackage(defusedexpatonPyPI)comeswithbinaryextensionsandamodifiedexpatlibaryinsteadofthestandardexpatparser.It’sbasicallyastand-aloneversionofthepatchesforPython’sstandardlibraryCextensions.

Modificationsinexpat

newdefinitions:

XML_BOMB_PROTECTIONXML_DEFAULT_MAX_ENTITY_INDIRECTIONSXML_DEFAULT_MAX_ENTITY_EXPANSIONSXML_DEFAULT_RESET_DTD

newXML_FeatureEnummembers:

XML_FEATURE_MAX_ENTITY_INDIRECTIONSXML_FEATURE_MAX_ENTITY_EXPANSIONSXML_FEATURE_IGNORE_DTD

newXML_Errormembers:

XML_ERROR_ENTITY_INDIRECTIONSXML_ERROR_ENTITY_EXPANSION

newAPIfunctions:

intXML_GetFeature(XML_Parserparser,enumXML_FeatureEnumfeature,long*value);intXML_SetFeature(XML_Parserparser,enumXML_FeatureEnumfeature,longvalue);intXML_GetFeatureDefault(enumXML_FeatureEnumfeature

XML_FEATURE_MAX_ENTITY_INDIRECTIONS

Limittheamountofindirectionsthatareallowedtooccurduringtheexpansionofanestedentity.Acounterstartswhenanentityreferenceisencountered.Itresetsa�ertheentityisfullyexpanded.Thelimitprotectstheparseragainstexponentialentityexpansionattacks(akabillionlaughsattack).WhenthelimitisexceededtheparserstopsandfailswithXML_ERROR_ENTITY_INDIRECTIONS.Avalueof0disablestheprotection.

Supportedrange0..UINT_MAX

Default40

XML_FEATURE_MAX_ENTITY_EXPANSIONS

Limitthetotallengthofallentityexpansionsthroughouttheentiredocument.Thelengthsofallentitiesareaccumulatedinaparservariable.Thesettingprotectsagainstquadraticblowupattacks(lotsofexpansionsofalargeentitydeclaration).Whenthesumofallentitiesexceedsthelimit,theparserstopsandfailswithXML_ERROR_ENTITY_EXPANSION.Avalueof0disablestheprotection.

Supportedrange0..UINT_MAX

Default8MiB

XML_FEATURE_RESET_DTD

ResetallDTDinformationa�erthe<!DOCTYPE>blockhasbeenparsed.Whentheflagisset(default:false)allDTDinformationa�ertheendDoctypeDeclHandlerhasbeencalled.TheflagcanbesetinsidetheendDoctypeDeclHandler.WithoutDTD

long*value);intXML_SetFeatureDefault(enumXML_FeatureEnumfeaturelongvalue);

informationanyentityreferenceinthedocumentbodyleadstoXML_ERROR_UNDEFINED_ENTITY.

Supportedrange0,1

Default0

HowtoavoidXMLvulnerabilities

Bestpractices

Don’tallowDTDs

Don’texpandentities

Don’tresolveexternals

Limitparsedepth

Limittotalinputsize

Limitparsetime

FavoraSAXoriterparse-likeparserforpotentiallargedata

ValidateandproperlyquoteargumentstoXSLtransformationsandXPathqueries

Don’tuseXPathexpressionfromuntrustedsources

Don’tapplyXSLtransformationsthatcomeuntrustedsources

(basedonBradHill’sAttackingXMLSecurity)

Otherthingstoconsider

XML,XMLparsersandprocessinglibrarieshavemorefeaturesandpossibleissuethatcouldleadtoDoSvulnerabilitiesorsecurityexploitsinapplications.Ihavecompiledanincompletelistoftheoreticalissuesthatneedfurtherresearchandmoreattention.Thelistisdeliberatelypessimisticandabitparanoid,too.Itcontainsthingsthatmightgowrongunderda�ycircumstances.

attributeblowup/hashcollisionattack

XMLparsersmayuseanalgorithmwithquadraticruntimeO(n )tohandleattributesandnamespaces.Ifituseshashtables(dictionaries)tostoreattributesandnamespacestheimplementationmaybevulnerabletohashcollisionattacks,thusreducingtheperformancetoO(n )again.IneithercaseanattackerisabletoforgeadenialofserviceattackwithanXMLdocumentthatcontainsthousandsuponthousandsofattributesinasinglenode.

Ihaven’tresearchedyetifexpat,pyexpatorlibxml2arevulnerable.

decompressionbomb

Theissueofdecompressionbombs(akaZIPbomb)applytoallXMLlibrariesthatcanparsecompressedXMLstreamlikegzippedHTTPstreamsorLZMA-edfiles.Foranattackeritcanreducetheamountoftransmitteddatabythreemagnitudesormore.Gzipisabletocompress1GiBzerostoroughly1MB,lzmaisevenbetter:

NoneofPython’sstandardXMLlibrariesdecompressstreamsexceptfor xmlrpclib .Themoduleisvulnerable<http://bugs.python.org/issue16043>todecompressionbombs.

lxmlcanloadandprocesscompresseddatathroughlibxml2transparently.libxml2canhandleevenverylargeblobsofcompresseddatae�icientlywithoutusingtoomuchmemory.Butitdoesn’tprotectapplicationsfromdecompressionbombs.AcarefullywrittenSAXoriterparse-likeapproachcanbesafe.

ProcessingInstruction

PI’slike:

$ddif=/dev/zerobs=1Mcount=1024|gzip>zeros.gz$ddif=/dev/zerobs=1Mcount=1024|lzma-z>zeros.x$ls-shzeros.*1020Kzeros.gz148Kzeros.xy

<?xml-stylesheettype="text/xsl"href="style.xsl"?>

mayimposemorethreatsforXMLprocessing.Itdependsifandhowaprocessorhandlesprocessinginstructions.TheissueofURLretrievalwithnetworkorlocalfileaccessapplytoprocessinginstructions,too.

OtherDTDfeatures

DTDhasmorefeatureslike <!NOTATION> .Ihaven’tresearchedhowthesefeaturesmaybeasecuritythreat.

XPathstatementsmayintroduceDoSvulnerabilities.Codeshouldneverexecutequeriesfromuntrustedsources.AnattackermayalsobeabletocreateaXMLdocumentthatmakescertainXPathqueriescostlyorresourcehungry.

XPathinjectionattacks

XPathinjecitonattacksprettymuchworklikeSQLinjectionattacks.ArgumentstoXPathqueriesmustbequotedandvalidatedproperly,especiallywhentheyaretakenfromtheuser.ThepageAvoidthedangersofXPathinjectionlistsomeramificationsofXPathinjections.

Python’sstandardlibrarydoesn’thaveXPathsupport.LxmlsupportsparameterizedXPathquerieswhichdoesproperquoting.Youjusthavetouseitsxpath()methodcorrectly:

#DON'T>>>tree.xpath("/tag[@id='%s']"%value)#insteaddo>>>tree.xpath("/tag[@id=$tagid]",tagid=name)

XInclude

XMLInclusionisanotherwaytoloadandincludeexternalfiles:

<rootxmlns:xi="http://www.w3.org/2001/XInclude"><xi:includehref="filename.txt"parse="text"/></root>

ThisfeatureshouldbedisabledwhenXMLfilesfromanuntrustedsourceareprocessed.SomePythonXMLlibrariesandlibxml2supportXIncludebutdon’thaveanoptiontosandboxinclusionandlimitittoalloweddirectories.

XMLSchemalocation

AvalidatingXMLparsermaydownloadschemafilesfromtheinformationina xsi:schemaLocation attribute.

XSLTransformation

YoushouldkeepinmindthatXSLTisaTuringcompletelanguage.NeverprocessXSLTcodefromunknownoruntrustedsource!XSLTprocessorsmayallowyoutointeractwithexternalresourcesinwaysyoucan’tevenimagine.Someprocessorsevensupportextensionsthatallowread/writeaccesstofilesystem,accesstoJREobjectsorscriptingwithJython.

ExamplefromAttackingXMLSecurityforXalan-J:

<eadxmlns="urn:isbn:1-931666-22-9"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instxsi:schemaLocation="urn:isbn:1-931666-22-9http:</ead>

<xsl:stylesheetversion="1.0"xmlns:xsl="http://www.w3.org/1999/XSL/Transform"

RelatedCVEs

CVE-2013-1664UnrestrictedentityexpansioninducesDoSvulnerabilitiesinPythonXMLlibraries(XMLbomb)

CVE-2013-1665ExternalentityexpansioninPythonXMLlibrariesinflictspotentialsecurityflawsandDoSvulnerabilities

Otherlanguages/frameworks

Severalotherprogramminglanguagesandframeworksarevulnerableaswell.Acoupleofthemarea�ectedbythefactthatlibxml2upto2.9.0hasnoprotectionagainstquadraticblowupattacks.Mostofthemhavepotentialdangerousdefaultsettingsforentityexpansionandexternalentities,too.

Perl’sXML::Simpleisvulnerabletoquadraticentityexpansionandexternalentityexpansion(bothlocalandremote).

Ruby’sREXMLdocumentparserisvulnerabletoentityexpansionattacks(bothquadraticandexponential)butitdoesn’tdoexternal

xmlns:rt="http://xml.apache.org/xalan/java/java.langxmlns:ob="http://xml.apache.org/xalan/java/java.langexclude-result-prefixes="rtob"><xsl:templatematch="/"><xsl:variablename="runtimeObject"select="rt:getR<xsl:variablename="command"select="rt:exec($runtimeObject,'c:\Windows<xsl:variablename="commandAsString"select="ob:toS<xsl:value-ofselect="$commandAsString"/></xsl:template></xsl:stylesheet>

entityexpansionbydefault.Inordertocounteractentityexpansionyouhavetodisablethefeature:

REXML::Document.entity_expansion_limit=0

libxml-rubyandhpricotdon’texpandentitiesintheirdefaultconfiguration.

PHP’sSimpleXMLAPIisvulnerabletoquadraticentityexpansionandloadsentitesfromlocalandremoteresources.TheoptionLIBXML_NONET disablesnetworkaccessbutstillallowslocalfileaccess. LIBXML_NOENT seemstohavenoe�ectonentityexpansioninPHP5.4.6.

C#/.NET/Mono

InformationinXMLDoSandDefenses(MSDN)suggestthat.NETisvulnerablewithitsdefaultsettings.ThearticlecontainscodesnippetshowtocreateasecureXMLreader:

Untested.ThedocumentationofXercesanditsXercesSecurityManangersoundslikeXercesisalsovulnerabletobillionlaughattackswithitsdefaultsettings.Italsodoesentityresolvingwhenan org.xml.sax.EntityResolver isconfigured.I’mnotyetsureaboutthedefaultsettinghere.

XmlReaderSettingssettings=newXmlReaderSettings();settings.ProhibitDtd=false;settings.MaxCharactersFromEntities=1024;settings.XmlResolver=null;XmlReaderreader=XmlReader.Create(stream,settings)

Javaspecialistssuggesttohaveacustombuilderfactory:

DOM:Usexml.dom.xmlbuilderoptionsforentityhandling

SAX:takefeature_external_gesandfeature_external_pes(?)intoaccount

testexperimentalmonkeypatchingofstdlibmodules

improvedocumentation

License

LicensedtoPSFunderaContributorAgreement.

Seehttp://www.python.org/psf/licenseforlicensingdetails.

Acknowledgements

BrettCannon(PythonCoredeveloper)reviewandcodecleanup

AntoinePitrou(PythonCoredeveloper)codereview

DocumentBuilderFactorybuilderFactory=DocumentBuildebuilderFactory.setXIncludeAware(False);builderFactory.setExpandEntityReferences(False);builderFactory.setFeature(XMLConstants.FEATURE_SECURE_#eitherbuilderFactory.setFeature("http://apache.org/xml/feat#orifyouneedDTDsbuilderFactory.setFeature("http://xml.org/sax/featuresbuilderFactory.setFeature("http://xml.org/sax/featuresbuilderFactory.setFeature("http://apache.org/xml/featbuilderFactory.setFeature("http://apache.org/xml/feat

AaronPatterson,BenMurphyandMichaelKoziarski(Rubycommunity)

ManythankstoAaron,BenandMichaelfromtheRubycommunityfortheirreportandassistance.

ThierryCarrez(OpenStack)ManythankstoThierryforhisreporttothePythonSecurityResponseTeamonbehalfoftheOpenStacksecurityteam.

CarlMeyer(Django)ManythankstoCarlforhisreporttoPSRTonbehalfoftheDjangosecurityteam.

DanielVeillard(libxml2)ManythankstoDanielforhisinsightandassistancewithlibxml2.

semanticsGmbH(http://www.semantics.de/)Manythankstomyemployersemanticsforlettingmeworkontheissueduringworkinghoursaspartofsemantics’sopensourceinitiative.

References

XMLDoSandDefenses(MSDN)

BillionLaughsonWikipedia

ZIPbombonWikipedia

ConfigureSAXparsersforsecureprocessing

TestingforXMLInjection

Changelog

defusedxml0.5.0

Releasedate:07-Feb-2017

Nochanges

defusedxml0.5.0.rc1

Releasedate:28-Jan-2017

AddcompatibilitywithPython3.6

DropsupportforPython2.6,3.1,3.2,3.3

Fixlxmltests(XMLSyntaxError:Detectedanentityreferenceloop)

defusedxml0.4.1

Releasedate:28-Mar-2013

Addmoredemoexploits,e.g.python_external.pyandXalanXSLTdemos.

Improveddocumentation.

defusedxml0.4

Asperhttp://seclists.org/oss-sec/2013/q1/340pleaseREJECTCVE-2013-0278,CVE-2013-0279andCVE-2013-0280anduseCVE-2013-1664,CVE-2013-1665forOpenStack/etc.

Addmissingparser_listargumenttosax.make_parser().Theargumentisignored,though.(thankstoFlorianApolloner)

AdddemoexploitforexternalentityattackonPython’sSAXparser,XML-RPCandWebDAV.

defusedxml0.3

Improvedocumentation

defusedxml0.2

RenameExternalEntitiesForbiddentoExternalReferenceForbidden

Renamedefusedxml.lxml.check_dtd()tocheck_docinfo()

Unifyargumentnamesincallbacks

Addargumentsandformattedrepresentationtoexceptions

Addforbid_externalargumenttoallfunctionsandclasss

Moretests

LOTSofdocumentation

Addexamplecodeforotherlanguages(Ruby,Perl,PHP)andparsers(Genshi)

AddprotectionagainstXMLandgzipattackstoxmlrpclib

defusedxml0.1

InitialandinternalreleaseforPSRTreview

Installingpackages

Uploadingpackages

Userguide

AboutPyPI

PyPIonTwitter

Infrastructuredashboard

Packageindexnameretention

Oursponsors

ContributingtoPyPI

Bugsandfeedback

ContributeonGitHub

UsingPyPI

Codeofconduct

Reportsecurityissue

Developmentcredits Privacypolicy

Termsofuse

Status:AllSystemsOperational

DevelopedandmaintainedbythePythoncommunity,forthePythoncommunity.Donatetoday!

Desktopversion

ElasticSearch

PingdomMonitoring

GoogleBigQuery

SentryErrorlogging

AWSCloudcomputing

DataDogMonitoring

FastlyCDN

SignalFxSupporter

DigiCertEVcertificate

StatusPageStatuspage

defusedxml · pypi · 2019-09-16 · synopsis the results of an ... long time with a small to...

Documents

ebilling synopsis

cherrypy - tutorialspoint · step 3: easy_install will...

cffi and pypy - swiss python summit · cffi i successful...

pyp synopsis

option synopsis central rift basin option synopsis central...

individual mitigating circumstances & assessment ·...

writing the synopsis writing the synopsis writing for the...

changing circumstances?

project synopsis

release 0.7 federico capoano · contents 1 setup 3 1.1...

a global synopsis of groundwater science and transboundary...

circumstances; and

review: what’s the object? what’s the object? motive?...

synopsis 1

species synopsis no, 19 fao fisheries biology synopsis no

extraordinary circumstances extraordinary circumstances ......

extenuating circumstances 2013/14 definition of ecs...

extenuating circumstances

6j mitigating circumstances including extensions: policy...

formatted synopsis