search

mx-moth / flask-saml2

Flask library for building SAML Service Providers and Identity Providers
MIT License
70 stars 60 forks source link

Deprecation warning for defusedxml #9

Open baszoetekouw opened 4 years ago

baszoetekouw commented 4 years ago

With flask-saml 0.2.0, I get the following depreciation warning:

/tmp/env/lib/python3.7/site-packages/flask_saml2/xml_parser.py:9
  /tmp/env/lib/python3.7/site-packages/flask_saml2/xml_parser.py:9: DeprecationWarning: defusedxml.lxml is no longer supported and will be removed in a future release.
    import defusedxml.lxml

More information is provided at https://github.com/tiran/defusedxml#defusedxmllxml

DEPRECATED The module is deprecated and will be removed in a future release.

The module acts as an example how you could protect code that uses lxml.etree. It implements a custom Element class that filters out Entity instances, a custom parser factory and a thread local storage for parser instances. It also has a check_docinfo() function which inspects a tree for internal or external DTDs and entity declarations. In order to check for entities lxml > 3.0 is required.