Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. - Githubissues

chssn / uk-dataset

UK Profile for vatSys

0 stars 0 forks source link

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. #1

Closed chssn closed 3 years ago

chssn commented 3 years ago

Codacy detected an issue:

Message: `Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.`

Occurred on:

Commit: ba2d61e8fd6f4034764bf051c068976fa8226e50
File: ConversionTools/convertGeoJson.py
LineNum: 4
Code: import xml.etree.ElementTree as xtree

Currently on:

Commit: 4b48ce58b6f5102913f238e4b1f52553cf4657c1
File: ConversionTools/convertGeoJson.py
LineNum: 4