Update xlsm_wrapper.py - Githubissues

DissectMalware / XLMMacroDeobfuscator

Extract and Deobfuscate XLM macros (a.k.a Excel 4.0 Macros)

Apache License 2.0

568 stars 116 forks source link

Update xlsm_wrapper.py #92

Closed vaq130 closed 2 years ago

vaq130 commented 2 years ago

xml.etree.ElementTree.fromstring is insecure against maliciously constructed data. Recommend switching to defusedxml.ElementTree

https://docs.python.org/3/library/xml.etree.elementtree.html

DissectMalware commented 2 years ago

Thank you for the PR.

I added the package to requirements.txt and also to setup.py. However, I made it optional for the time being. if defusedxml package is not installed on a machine, xlmdeofuscator warns the user and continues using xml.etree package