mirror of
https://github.com/github/codeql.git
synced 2026-03-28 02:08:17 +01:00
55 lines
3.1 KiB
Python
55 lines
3.1 KiB
Python
from io import StringIO
|
|
import lxml.etree
|
|
|
|
x = "some xml"
|
|
|
|
# different parsing methods
|
|
lxml.etree.fromstring(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
lxml.etree.fromstring(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
lxml.etree.fromstringlist([x]) # $ decodeFormat=XML decodeInput=List xmlVuln='XXE' decodeOutput=lxml.etree.fromstringlist(..)
|
|
lxml.etree.fromstringlist(strings=[x]) # $ decodeFormat=XML decodeInput=List xmlVuln='XXE' decodeOutput=lxml.etree.fromstringlist(..)
|
|
|
|
lxml.etree.XML(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.XML(..)
|
|
lxml.etree.XML(text=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.XML(..)
|
|
|
|
lxml.etree.parse(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parse(..)
|
|
lxml.etree.parse(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parse(..)
|
|
|
|
lxml.etree.parseid(StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parseid(..)
|
|
lxml.etree.parseid(source=StringIO(x)) # $ decodeFormat=XML decodeInput=StringIO(..) xmlVuln='XXE' decodeOutput=lxml.etree.parseid(..)
|
|
|
|
# With default parsers (nothing changed)
|
|
parser = lxml.etree.XMLParser()
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
parser = lxml.etree.get_default_parser()
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
# manual use of feed method
|
|
parser = lxml.etree.XMLParser()
|
|
parser.feed(x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE'
|
|
parser.feed(data=x) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE'
|
|
parser.close() # $ decodeOutput=parser.close()
|
|
|
|
# XXE-safe
|
|
parser = lxml.etree.XMLParser(resolve_entities=False)
|
|
lxml.etree.fromstring(x, parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
# XXE-vuln
|
|
parser = lxml.etree.XMLParser(resolve_entities=True)
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
# Billion laughs vuln (also XXE)
|
|
parser = lxml.etree.XMLParser(huge_tree=True)
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='Billion Laughs' xmlVuln='Quadratic Blowup' xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
# Safe for both Billion laughs and XXE
|
|
parser = lxml.etree.XMLParser(resolve_entities=False, huge_tree=True)
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x decodeOutput=lxml.etree.fromstring(..)
|
|
|
|
# DTD retrival vuln (also XXE)
|
|
parser = lxml.etree.XMLParser(load_dtd=True, no_network=False)
|
|
lxml.etree.fromstring(x, parser=parser) # $ decodeFormat=XML decodeInput=x xmlVuln='DTD retrieval' xmlVuln='XXE' decodeOutput=lxml.etree.fromstring(..)
|