hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Fix huge_tree modeling

Browse Source
This commit is contained in:
Rasmus Wriedt Larsen
2022-03-04 09:49:00 +01:00
parent d6cbfec434
commit f0131afc54
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
python/ql/test/experimental/library-tests/frameworks/XML/lxml_etree.py
View File

@@ -47,7 +47,7 @@ lxml.etree.fromstring(x, parser=parser) # $ input=x vuln='Billion Laughs' vuln='
# Safe for both Billion laughs and XXE
parser = lxml.etree.XMLParser(resolve_entities=False, huge_tree=True)
lxml.etree.fromstring(x, parser=parser) # $ input=x SPURIOUS: vuln='Billion Laughs' vuln='Quadratic Blowup'
lxml.etree.fromstring(x, parser=parser) # $ input=x
# DTD retrival vuln (also XXE)
parser = lxml.etree.XMLParser(load_dtd=True, no_network=False)