Re: The history of PyXML

--===============5562161607229854015==
Content-Type: multipart/alternative; boundary="0000000000002ccacc056d4f8c82"

--0000000000002ccacc056d4f8c82
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, May 17, 2018, Serhiy Storchaka <[email protected]> wrote:

> [...]
>
> I'm trying to figure out some intentions and fix possible bugs in the xml
> package.


defusedxml
https://pypi.org/project/defusedxml/

> XML bomb protection for Python stdlib modules

https://pypi.org/project/defusedxml/#how-to-avoid-xml-vulnerabilities

"""
Best practices
- Don=E2=80=99t allow DTDs
- Don=E2=80=99t expand entities
- Don=E2=80=99t resolve externals
- Limit parse depth
- Limit total input size
- Limit parse time
- Favor a SAX or iterparse-like parser for potential large data
- Validate and properly quote arguments to XSL transformations and XPath
queries
- Don=E2=80=99t use XPath expression from untrusted sources
- Don=E2=80=99t apply XSL transformations that come untrusted sources
"""

https://github.com/tiran/defusedxml


> The history of all commits could help.
>
> _______________________________________________
> Python-Dev mailing list
> [email protected]
> https://mail.python.org/mailman/listinfo/python-dev
> Unsubscribe: https://mail.python.org/mailman/options/python-dev/wes.
> turner%40gmail.com
>

--0000000000002ccacc056d4f8c82
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, May 17, 2018, Serhiy Storchaka &lt;<a href=3D"mailto:storchaka=
@gmail.com">[email protected]</a>&gt; wrote:<br><blockquote class=3D"gmai=
l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left=
:1ex">[...]<br>
<br>
I&#39;m trying to figure out some intentions and fix possible bugs in the x=
ml package.=C2=A0</blockquote><div>=C2=A0</div><div>defusedxml</div><div><a=
 href=3D"https://pypi.org/project/defusedxml/">https://pypi.org/project/def=
usedxml/</a><br></div><div><br></div><div>&gt; XML bomb protection for Pyth=
on stdlib modules<br></div><div><br></div><div><a href=3D"https://pypi.org/=
project/defusedxml/#how-to-avoid-xml-vulnerabilities">https://pypi.org/proj=
ect/defusedxml/#how-to-avoid-xml-vulnerabilities</a><br></div><div><br></di=
v><div><div>&quot;&quot;&quot;</div><div>Best practices</div><div>- Don=E2=
=80=99t allow DTDs</div><div>- Don=E2=80=99t expand entities</div><div>- Do=
n=E2=80=99t resolve externals</div><div>- Limit parse depth</div><div>- Lim=
it total input size</div><div>- Limit parse time</div><div>- Favor a SAX or=
 iterparse-like parser for potential large data</div><div>- Validate and pr=
operly quote arguments to XSL transformations and XPath queries</div><div>-=
 Don=E2=80=99t use XPath expression from untrusted sources</div><div>- Don=
=E2=80=99t apply XSL transformations that come untrusted sources</div><div>=
&quot;&quot;&quot;</div></div><div><br></div><div><a href=3D"https://github=
.com/tiran/defusedxml">https://github.com/tiran/defusedxml</a><br></div><di=
v><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex"><br></blockquote><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;pa=
dding-left:1ex">The history of all commits could help.<br>
<br>
______________________________<wbr>_________________<br>
Python-Dev mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Python-Dev@pytho=
n.org</a><br>
<a href=3D"https://mail.python.org/mailman/listinfo/python-dev" target=3D"_=
blank">https://mail.python.org/mailma<wbr>n/listinfo/python-dev</a><br>
Unsubscribe: <a href=3D"https://mail.python.org/mailman/options/python-dev/=
wes.turner%40gmail.com" target=3D"_blank">https://mail.python.org/mailma<wb=
r>n/options/python-dev/wes.<wbr>turner%40gmail.com</a><br>
</blockquote>

--0000000000002ccacc056d4f8c82--

--===============5562161607229854015==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline