Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork33.7k
Closed
Description
Documentation
The currentdocumentation onxml.sax.handler.feature_external_ges…
…fails to warn that enablingfeature_external_ges will make the XML parser vulnerable toexternal entity attacks.
For a demo:
# Copyright (c) 2025 Sebastian Pipping <sebastian@pipping.org># SPDX-License-Identifier: 0BSDfromioimportStringIOfromtextwrapimportdedentfromxml.sax.expatreaderimportcreate_parserfromxml.sax.handlerimportfeature_external_gesparser=create_parser()parser.setFeature(feature_external_ges,1)content=dedent("""\ <!DOCTYPE root SYSTEM "https://host.invalid/404.dtd"> <root/>""")parser.parse(StringIO(content))
Linked PRs
- gh-141994: Warn of XXE vulnerability in documentation of SAX feature
xml.sax.handler.feature_external_ges#141996 - [3.14] gh-141994: Warn of XXE vulnerability in documentation of SAX feature
xml.sax.handler.feature_external_ges(GH-141996) #142072 - [3.13] gh-141994: Warn of XXE vulnerability in documentation of SAX feature
xml.sax.handler.feature_external_ges(GH-141996) #142073
Metadata
Metadata
Assignees
Projects
Status
Todo