7 ms·
Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?
by metafunctor 2y ago
Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?
- slau 2y agoFrom the author themselves, 6 years ago: > defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion. https://github.com/tiran/defusedxml/issues/25#issuecomment-422436105 https://github.com/tiran/defusedxml/issues/25#issuecomment-4...
- metafunctor 2y agoOK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.
- masklinn 2y agoNote that this is not enabled by default, although there is an upper bound on tree size which does limit the reach of the issue. See https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs https://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs for more about the tuning knobs.
- JonChesterfield 2y agolibxml2 segfaults on me whenever I give it vaguely complicated xsl templates so I'm doubtful about how effective that handling will be.
- masklinn 2y agoIf you’re trying to use it for lxml then yes, it was only ever experimental and has been deprecated (it also failed to define some interfaces correctly causing issues). If you’re using it over the stdlib then no.