hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update .qlref

Browse Source
This commit is contained in:
jorgectf
2021-09-07 20:13:39 +02:00
parent 48bca5beb8
commit 21da603d81
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
python/ql/src/experimental/Security/CWE-611/XXE.qlref
View File

@@ -12,18 +12,16 @@ data retrieval techniques may allow attackers to steal sensitive data. Denial of
in this situation.
</p>
<p>
There are many XML parsers for Python, and most of them are vulnerable to XXE because their default settings enable
parsing of external entities. This query currently identifies vulnerable XML parsing from the following parsers:
<code>xml.etree.ElementTree.XMLParser</code>, <code>lxml.etree.XMLParser</code>, <code>lxml.etree.get_default_parser</code>,
<code>xml.sax.make_parser</code>.
Refer to the following links to check the details regarding how and which libraries are vulnerable:
<li><a href="https://docs.python.org/3/library/xml.html#xml-vulnerabilities">Python 3</a>.</li>
<li><a href="https://docs.python.org/2/library/xml.html#xml-vulnerabilities">Python 2</a>.</li>
</p>
</overview>
<recommendation>
<p>
The best way to prevent XXE attacks is to disable the parsing of any Document Type Declarations (DTDs) in untrusted data.
If this is not possible you should disable the parsing of external general entities and external parameter entities.
This improves security but the code will still be at risk of denial of service and server side request forgery attacks.
Use <a href="https://docs.python.org/3/library/xml.html#the-defusedxml-package">defusedxml</a>, a Python package aimed
to prevent any potentially malicious operation.
</p>
</recommendation>