Closed morenopc closed 2 years ago
Thanks, @morenopc ! I will consider that change and maybe release a security fix soon.
I tried to prevent some of this in #90 but in the end I made another release (1.2.1) which switches to defusedxml
instead of xml.sax
.
I'd like to mention that
xml.sax
package is vulnerable to XML External Entities (XXE) injection.The feature_external_ges is
True
by defaulttrue: Include all external general (text) entities
which means vulnerable to XXE injection.For example, a possible solution could be set to
False
at untangle.py#L185Please check: