Package: defusedexpat
Table of ContentsCountermeasuresModificationsModifications in pyexpatModifications in _elementtreeModifications in expatRequirementsLicenseContributorsChangelogdefusedexpat 0.4defusedexpat 0.3defusedexpat 0.2defusedexpat 0.1defusedexpat protects the XML packages of Python’s standard library from
several denial of service vulnerabilities and external entity exploits. It
containsa modified and enhanced version of expat parser libraryreplacements for pyexpat and cElementTree’s _elementtree extension modulesloader code that replaces built-in extensions with the modified extensionsmonkey patches for xml.sax and xml.dom to prevent external entity expansionsIn order to protect your application you have to import thedefusedxmlmodulebeforeany of the stdlib’s XML modules.Countermeasureslimited entity expansion level to antagonize billion laugh attackslimited total length of expansions to prevent quadratic blowupsmonkey patch to prevent retrieval of external entities and DTDsModificationsModifications in pyexpatParser objectNew parser attributes (r/w)max_entity_indirectionsmax_entity_expansionsreset_dtdModule constantsXML_DEFAULT_MAX_ENTITY_INDIRECTIONSXML_DEFAULT_MAX_ENTITY_EXPANSIONSXML_BOMB_PROTECTIONModules functionsget_reset_dtd(), set_reset_dtd(bool)get_max_entity_expansions(), set_max_entity_expansions(int)get_max_entity_indirections(), et_max_entity_indirections(int)New CAPI memberscapi.GetFeaturecapi.SetFeaturecapi.GetFeatureDefaultcapi.SetFeatureDefaultModifications in _elementtree_elementtree.XMLParserNew arguments and r/o attributesmax_entity_indirectionsmax_entity_expansionsignore_dtdModifications in expatnew definitions:XML_BOMB_PROTECTION
XML_DEFAULT_MAX_ENTITY_INDIRECTIONS
XML_DEFAULT_MAX_ENTITY_EXPANSIONS
XML_DEFAULT_RESET_DTDnew XML_FeatureEnum members:XML_FEATURE_MAX_ENTITY_INDIRECTIONS
XML_FEATURE_MAX_ENTITY_EXPANSIONS
XML_FEATURE_IGNORE_DTDnew XML_Error members:XML_ERROR_ENTITY_INDIRECTIONS
XML_ERROR_ENTITY_EXPANSIONnew API functions:int XML_GetFeature(XML_Parser parser,
                   enum XML_FeatureEnum feature,
                   long *value);
int XML_SetFeature(XML_Parser parser,
                   enum XML_FeatureEnum feature,
                   long value);
int XML_GetFeatureDefault(enum XML_FeatureEnum feature,
                          long *value);
int XML_SetFeatureDefault(enum XML_FeatureEnum feature,
                          long value);XML_FEATURE_MAX_ENTITY_INDIRECTIONSLimit the amount of indirections that are allowed to occur during the
expansion of a nested entity. A counter starts when an entity reference
is encountered. It resets after the entity is fully expanded. The limit
protects the parser against exponential entity expansion attacks (aka
billion laughs attack). When the limit is exceeded the parser stops and
fails withXML_ERROR_ENTITY_INDIRECTIONS.
A value of 0 disables the protection.Supported range0 .. UINT_MAXDefault40XML_FEATURE_MAX_ENTITY_EXPANSIONSLimit the total length of all entity expansions throughout the entire
document. The lengths of all entities are accumulated in a parser variable.
The setting protects against quadratic blowup attacks (lots of expansions
of a large entity declaration). When the sum of all entities exceeds
the limit, the parser stops and fails withXML_ERROR_ENTITY_EXPANSION.
A value of 0 disables the protection.Supported range0 .. UINT_MAXDefault8 MiBXML_FEATURE_RESET_DTDReset all DTD information after the <!DOCTYPE> block has been parsed. When
the flag is set (default: false) all DTD information after the
endDoctypeDeclHandler has been called. The flag can be set inside the
endDoctypeDeclHandler. Without DTD information any entity reference in
the document body leads toXML_ERROR_UNDEFINED_ENTITY.Supported range0, 1Default0RequirementsPython 2.6.6 or newer (2.6.8 or newer for randomized hashing)Python 2.7 (2.7.3 or newer for randomized hashing and Windows binaries)Python 3.1 (3.1.5 or newer for randomized hashing and Windows binaries)Python 3.2 (3.2.3 or newer for randomized hashing and Windows binaries)Python 3.3.0 or newerWindows binaries are compatible to 2.6.6, 2.7.3, 3.1.5, 3.2.3 or 3.3.0 or
newer micro releases. They don’t work on older versions.LicenseCopyright (c) 2013 by Christian Heimes <christian@python.org>Licensed to PSF under a Contributor Agreement.Seehttp://www.python.org/psf/licensefor licensing details.ContributorsAntoine Pitroucode reviewBrett Cannoncode reviewChangelogdefusedexpat 0.4Release date: 25-Feb-2013Make code source compatible to Python versions without hash randomization.Include latest version of expat patchdefusedexpat 0.3Release date: 19-Feb-2013Disable some tests on Windows because proxy trick doesn’t workRemove ‘bomb protection’ suffix from CAPI MAGICDon’t support additional kwargs in _elementtree when XML_BOMB_PROTECTION
is not available.Implement better and more flexibel get/set feature API in expatAdd module functions to set global settingsdefusedexpat 0.2Release date: 15-Feb-2013Python 3.1 supportMisc fixes and improvementsdefusedexpat 0.1Release date: 11-Feb-2013Initial and internal release for PSRT review