Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 1ea4bcc

Browse files
RasmusWLRasmusWL
committed
Python: Make XMLParsing a Decoding subclass
1 parent 35ccba2 commit 1ea4bcc

8 files changed

Lines changed: 124 additions & 88 deletions

File tree

‎python/ql/lib/semmle/python/Concepts.qll‎

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -580,12 +580,7 @@ module XML {
580580
* Extend this class to model new APIs. If you want to refine existing API models,
581581
* extend `XMLParsing` instead.
582582
*/
583-
class XMLParsing extends DataFlow::Node instanceof XMLParsing::Range {
584-
/**
585-
* Gets the argument containing the content to parse.
586-
*/
587-
DataFlow::Node getAnInput() { result = super.getAnInput() }
588-
583+
class XMLParsing extends Decoding instanceof XMLParsing::Range {
589584
/**
590585
* Holds if this XML parsing is vulnerable to `kind`.
591586
*/
@@ -600,16 +595,13 @@ module XML {
600595
* Extend this class to model new APIs. If you want to refine existing API models,
601596
* extend `XMLParsing` instead.
602597
*/
603-
abstract class Range extends DataFlow::Node {
604-
/**
605-
* Gets the argument containing the content to parse.
606-
*/
607-
abstract DataFlow::Node getAnInput();
608-
598+
abstract class Range extends Decoding::Range {
609599
/**
610600
* Holds if this XML parsing is vulnerable to `kind`.
611601
*/
612602
abstract predicate vulnerableTo(XMLParsingVulnerabilityKind kind);
603+
604+
override string getFormat() { result = "XML" }
613605
}
614606
}
615607
}

‎python/ql/src/experimental/semmle/python/frameworks/Xml.qll‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,15 @@ private module XmlEtree {
6969
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
7070
kind.isBillionLaughs() or kind.isQuadraticBlowup()
7171
}
72+
73+
override predicate mayExecuteInput() { none() }
74+
75+
override DataFlow::Node getOutput() {
76+
exists(DataFlow::Node objRef |
77+
DataFlow::localFlow(this.getObject(), objRef) and
78+
result.(DataFlow::MethodCallNode).calls(objRef, "close")
79+
)
80+
}
7281
}
7382
}
7483

@@ -108,6 +117,10 @@ private module XmlEtree {
108117
// change the security features anyway :|
109118
kind.isBillionLaughs() or kind.isQuadraticBlowup()
110119
}
120+
121+
override predicate mayExecuteInput() { none() }
122+
123+
override DataFlow::Node getOutput() { result = this }
111124
}
112125
}
113126

@@ -226,6 +239,15 @@ private module SaxBasedParsing {
226239
this.getObject() = saxParserWithFeatureExternalGesTurnedOn() and
227240
(kind.isXxe() or kind.isDtdRetrieval())
228241
}
242+
243+
override predicate mayExecuteInput() { none() }
244+
245+
override DataFlow::Node getOutput() {
246+
// note: the output of parsing with SAX is that the content handler gets the
247+
// data... but we don't currently model this (it's not trivial to do, and won't
248+
// really give us any value, at least not as of right now).
249+
none()
250+
}
229251
}
230252

231253
/**
@@ -259,6 +281,15 @@ private module SaxBasedParsing {
259281
this.getObject() = saxParserWithFeatureExternalGesTurnedOn() and
260282
(kind.isXxe() or kind.isDtdRetrieval())
261283
}
284+
285+
override predicate mayExecuteInput() { none() }
286+
287+
override DataFlow::Node getOutput() {
288+
// note: the output of parsing with SAX is that the content handler gets the
289+
// data... but we don't currently model this (it's not trivial to do, and won't
290+
// really give us any value, at least not as of right now).
291+
none()
292+
}
262293
}
263294

264295
/**
@@ -296,6 +327,10 @@ private module SaxBasedParsing {
296327
or
297328
(kind.isBillionLaughs() or kind.isQuadraticBlowup())
298329
}
330+
331+
override predicate mayExecuteInput() { none() }
332+
333+
override DataFlow::Node getOutput() { result = this }
299334
}
300335
}
301336

@@ -400,6 +435,15 @@ private module Lxml {
400435
override predicate vulnerableTo(XML::XMLParsingVulnerabilityKind kind) {
401436
this.calls(instanceVulnerableTo(kind), "feed")
402437
}
438+
439+
override predicate mayExecuteInput() { none() }
440+
441+
override DataFlow::Node getOutput() {
442+
exists(DataFlow::Node objRef |
443+
DataFlow::localFlow(this.getObject(), objRef) and
444+
result.(DataFlow::MethodCallNode).calls(objRef, "close")
445+
)
446+
}
403447
}
404448
}
405449

@@ -442,6 +486,10 @@ private module Lxml {
442486
kind.isXxe() and
443487
not exists(this.getParserArg())
444488
}
489+
490+
override predicate mayExecuteInput() { none() }
491+
492+
override DataFlow::Node getOutput() { result = this }
445493
}
446494
}
447495

@@ -460,5 +508,9 @@ private module Xmltodict {
460508
(kind.isBillionLaughs() or kind.isQuadraticBlowup()) and
461509
this.getArgByName("disable_entities").getALocalSource().asExpr() = any(False f)
462510
}
511+
512+
override predicate mayExecuteInput() { none() }
513+
514+
override DataFlow::Node getOutput() { result = this }
463515
}
464516
}

‎python/ql/test/experimental/library-tests/frameworks/XML/lxml_etree.py‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,51 +4,51 @@
44
x = "some xml"
55

66
# different parsing methods
7-
lxml.etree.fromstring(x) # $ xmlInput=x xmlVuln='XXE'
8-
lxml.etree.fromstring(text=x) # $ xmlInput=x xmlVuln='XXE'
7+
lxml.etree.fromstring(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
8+
lxml.etree.fromstring(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
99

10-
lxml.etree.fromstringlist([x]) # $ xmlInput=List xmlVuln='XXE'
11-
lxml.etree.fromstringlist(strings=[x]) # $ xmlInput=List xmlVuln='XXE'
10+
lxml.etree.fromstringlist([x]) # $ decodeFormat=XML decodeInput=List xmlVuln='XXE' decodeOutput=lxml.etree.fromstringlist(..)
11+
lxml.etree.fromstringlist(strings=[x]) # $ decodeFormat=XML decodeInput=List xmlVuln='XXE' decodeOutput=lxml.etree.fromstringlist(..)
1212

13-
lxml.etree.XML(x) # $ xmlInput=x xmlVuln='XXE'
14-
lxml.etree.XML(text=x) # $ xmlInput=x xmlVuln='XXE'
13+
lxml.etree.XML(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.XML(..)
14+
lxml.etree.XML(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.XML(..)
1515

16-
lxml.etree.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
17-
lxml.etree.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
16+
lxml.etree.parse(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parse(..)
17+
lxml.etree.parse(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parse(..)
1818

19-
lxml.etree.parseid(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
20-
lxml.etree.parseid(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='XXE'
19+
lxml.etree.parseid(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parseid(..)
20+
lxml.etree.parseid(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parseid(..)
2121

2222
# With default parsers (nothing changed)
2323
parser = lxml.etree.XMLParser()
24-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
24+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
2525

2626
parser = lxml.etree.get_default_parser()
27-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
27+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
2828

2929
# manual use of feed method
3030
parser = lxml.etree.XMLParser()
31-
parser.feed(x) # $ xmlInput=x xmlVuln='XXE'
32-
parser.feed(data=x) # $ xmlInput=x xmlVuln='XXE'
33-
parser.close()
31+
parser.feed(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE'
32+
parser.feed(data=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE'
33+
parser.close() # $ decodeOutput=parser.close()
3434

3535
# XXE-safe
3636
parser = lxml.etree.XMLParser(resolve_entities=False)
37-
lxml.etree.fromstring(x, parser) # $ xmlInput=x
38-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x
37+
lxml.etree.fromstring(x, parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
38+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
3939

4040
# XXE-vuln
4141
parser = lxml.etree.XMLParser(resolve_entities=True)
42-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='XXE'
42+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
4343

4444
# Billion laughs vuln (also XXE)
4545
parser = lxml.etree.XMLParser(huge_tree=True)
46-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
46+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
4747

4848
# Safe for both Billion laughs and XXE
4949
parser = lxml.etree.XMLParser(resolve_entities=False, huge_tree=True)
50-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x
50+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
5151

5252
# DTD retrival vuln (also XXE)
5353
parser = lxml.etree.XMLParser(load_dtd=True, no_network=False)
54-
lxml.etree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='DTD retrieval' xmlVuln='XXE'
54+
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='DTD retrieval' xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)

‎python/ql/test/experimental/library-tests/frameworks/XML/xml_dom.py‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,26 @@
66
x = "some xml"
77

88
# minidom
9-
xml.dom.minidom.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
10-
xml.dom.minidom.parse(file=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
9+
xml.dom.minidom.parse(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.minidom.parse(..)
10+
xml.dom.minidom.parse(file=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.minidom.parse(..)
1111

12-
xml.dom.minidom.parseString(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
13-
xml.dom.minidom.parseString(string=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
12+
xml.dom.minidom.parseString(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.minidom.parseString(..)
13+
xml.dom.minidom.parseString(string=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.minidom.parseString(..)
1414

1515

1616
# pulldom
17-
xml.dom.pulldom.parse(StringIO(x))['START_DOCUMENT'][1] # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
18-
xml.dom.pulldom.parse(stream_or_string=StringIO(x))['START_DOCUMENT'][1] # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
17+
xml.dom.pulldom.parse(StringIO(x))['START_DOCUMENT'][1] # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.pulldom.parse(..)
18+
xml.dom.pulldom.parse(stream_or_string=StringIO(x))['START_DOCUMENT'][1] # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.pulldom.parse(..)
1919

20-
xml.dom.pulldom.parseString(x)['START_DOCUMENT'][1] # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
21-
xml.dom.pulldom.parseString(string=x)['START_DOCUMENT'][1] # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
20+
xml.dom.pulldom.parseString(x)['START_DOCUMENT'][1] # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.pulldom.parseString(..)
21+
xml.dom.pulldom.parseString(string=x)['START_DOCUMENT'][1] # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.dom.pulldom.parseString(..)
2222

2323

2424
# These are based on SAX parses, and you can specify your own, so you can expose yourself to XXE (yay/)
2525
parser = xml.sax.make_parser()
2626
parser.setFeature(xml.sax.handler.feature_external_ges, True)
27-
xml.dom.minidom.parse(StringIO(x), parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
28-
xml.dom.minidom.parse(StringIO(x), parser=parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
27+
xml.dom.minidom.parse(StringIO(x), parser) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=xml.dom.minidom.parse(..)
28+
xml.dom.minidom.parse(StringIO(x), parser=parser) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=xml.dom.minidom.parse(..)
2929

30-
xml.dom.pulldom.parse(StringIO(x), parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
31-
xml.dom.pulldom.parse(StringIO(x), parser=parser) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE'
30+
xml.dom.pulldom.parse(StringIO(x), parser) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=xml.dom.pulldom.parse(..)
31+
xml.dom.pulldom.parse(StringIO(x), parser=parser) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='DTD retrieval' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=xml.dom.pulldom.parse(..)

‎python/ql/test/experimental/library-tests/frameworks/XML/xml_etree.py‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -4,40 +4,40 @@
44
x = "some xml"
55

66
# Parsing in different ways
7-
xml.etree.ElementTree.fromstring(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
8-
xml.etree.ElementTree.fromstring(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
7+
xml.etree.ElementTree.fromstring(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.fromstring(..)
8+
xml.etree.ElementTree.fromstring(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.fromstring(..)
99

10-
xml.etree.ElementTree.fromstringlist([x]) # $ xmlInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
11-
xml.etree.ElementTree.fromstringlist(sequence=[x]) # $ xmlInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
10+
xml.etree.ElementTree.fromstringlist([x]) # $ decodeFormat=XML decodeInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.fromstringlist(..)
11+
xml.etree.ElementTree.fromstringlist(sequence=[x]) # $ decodeFormat=XML decodeInput=List xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.fromstringlist(..)
1212

13-
xml.etree.ElementTree.XML(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
14-
xml.etree.ElementTree.XML(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
13+
xml.etree.ElementTree.XML(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.XML(..)
14+
xml.etree.ElementTree.XML(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.XML(..)
1515

16-
xml.etree.ElementTree.XMLID(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
17-
xml.etree.ElementTree.XMLID(text=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
16+
xml.etree.ElementTree.XMLID(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.XMLID(..)
17+
xml.etree.ElementTree.XMLID(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.XMLID(..)
1818

19-
xml.etree.ElementTree.parse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
20-
xml.etree.ElementTree.parse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
19+
xml.etree.ElementTree.parse(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.parse(..)
20+
xml.etree.ElementTree.parse(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.parse(..)
2121

22-
xml.etree.ElementTree.iterparse(StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
23-
xml.etree.ElementTree.iterparse(source=StringIO(x)) # $ xmlInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
22+
xml.etree.ElementTree.iterparse(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.iterparse(..)
23+
xml.etree.ElementTree.iterparse(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.iterparse(..)
2424

2525

2626
# With parsers (no options available to disable/enable security features)
2727
parser = xml.etree.ElementTree.XMLParser()
28-
xml.etree.ElementTree.fromstring(x, parser=parser) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
28+
xml.etree.ElementTree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' decodeOutput=xml.etree.ElementTree.fromstring(..)
2929

3030
# manual use of feed method
3131
parser = xml.etree.ElementTree.XMLParser()
32-
parser.feed(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
33-
parser.feed(data=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
34-
parser.close()
32+
parser.feed(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
33+
parser.feed(data=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
34+
parser.close() # $ decodeOutput=parser.close()
3535

3636
# manual use of feed method on XMLPullParser
3737
parser = xml.etree.ElementTree.XMLPullParser()
38-
parser.feed(x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
39-
parser.feed(data=x) # $ xmlInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
40-
parser.close()
38+
parser.feed(x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
39+
parser.feed(data=x) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup'
40+
parser.close() # $ decodeOutput=parser.close()
4141

4242
# note: it's technically possible to use the thing wrapper func `fromstring` with an
4343
# `lxml` parser, and thereby change what vulnerabilities you are exposed to.. but it

0 commit comments

Comments
 (0)