From f5854f33da4a51c39e4a6bccb778393d92e29efe Mon Sep 17 00:00:00 2001 From: Rasmus Wriedt Larsen Date: Mon, 9 May 2022 10:53:25 +0200 Subject: [PATCH] Python: Apply suggestions from code review Co-authored-by: yoff --- python/ql/src/Security/CWE-776/XmlBomb.qhelp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/ql/src/Security/CWE-776/XmlBomb.qhelp b/python/ql/src/Security/CWE-776/XmlBomb.qhelp index f20dd526fdd..8841f98ab27 100644 --- a/python/ql/src/Security/CWE-776/XmlBomb.qhelp +++ b/python/ql/src/Security/CWE-776/XmlBomb.qhelp @@ -39,7 +39,7 @@ PyPI package, which has been created to prevent XML attacks (both XXE and XML bo

The following example uses the xml.etree XML parser provided by the Python standard library to -parse a string xml_src. That string is from an untrusted source, so this code is be +parse a string xml_src. That string is from an untrusted source, so this code is vulnerable to a DoS attack, since the xml.etree XML parser expands internal entities by default: