search

bird-house / twitcher

Security Proxy for Web Processing Services (WPS)
http://twitcher.readthedocs.io/en/latest/
Apache License 2.0
16 stars 4 forks source link

Consider replacing lxml by defusedxml #81

Open fmigneault opened 5 years ago

fmigneault commented 5 years ago

Resolves multiple attack methods through XML: https://pypi.org/project/defusedxml/#python-xml-libraries

Replacement seems relatively straighforward https://pypi.org/project/defusedxml/#defusedxml

cehbrecht commented 5 years ago

... I'm wondering why the security fix is not part of lxml itself.

fmigneault commented 5 years ago

My understanding is that, depending on the underlying c++ lib version used to build the python package, some settings are available/added to disable the processing of potentially "dangerous" items, but default values of these settings are not the sames across versions. Therefore the build environment for which you pull the package will cause different behaviours.

fmigneault commented 2 years ago

Same fix as pywps, OWSLib, Weaver should be applied here?