pi-lens

Version:

Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo

20 lines (19 loc) • 519 B

YAML

id: no-xxe-vulnerable-xml-parser
valid:
  - |
    import defusedxml.ElementTree as ET
    tree = ET.parse("file.xml")
  - |
    import xml.etree.ElementTree as ET
    parser = ET.XMLParser(resolve_entities=False)
    tree = ET.parse("file.xml", parser=parser)
invalid:
  - |
    import xml.etree.ElementTree
    tree = xml.etree.ElementTree.parse("untrusted.xml")
  - |
    import lxml.etree
    tree = lxml.etree.parse("untrusted.xml")
  - |
    parser = lxml.etree.XMLParser()
    tree = lxml.etree.parse("file.xml")