Disable entities while parsing XML

[jorgectf]

If an attacker supplies a url returning malicious XML content, they may be able to leak internal information such as files, and/or cause a denial of service.

Entrypoint:

digger/remove_leading_place.py

Line 15 in 399d0d5

url = request.args.get('url')

Getting into ocr_to_dict:

digger/remove_leading_place.py

Line 25 in 399d0d5

parsed_text = ocr_to_dict(url)

User-controlled URL request:

digger/remove_leading_place.py

Line 42 in 399d0d5

req = requests.get(url)

Vulnerable parser declaration:

digger/remove_leading_place.py

Lines 45 to 47 in 399d0d5

	parser = lxml.etree.XMLParser(ns_clean=True,
	recover=True,
	encoding='utf-8')

Sink:

digger/remove_leading_place.py

Line 49 in 399d0d5

xml = lxml.etree.fromstring(text, parser=parser)

More information:

• MITRE
• OWASP vulnerability description
• OWASP guidance on parsing xml files