Found during a security audit (session that produced PR #44).
Where: lib/gp2rs.py, lib/gp2rs_gpx.py, lib/loosefolder.py, lib/song.py, lib/gp2notation.py, lib/routers/ws_highway.py:731
Issue: These parse imported Guitar Pro / arrangement XML with stdlib xml.etree.ElementTree, which Python's own docs flag as vulnerable to entity-expansion DoS (though safe from XXE/SSRF by default since 3.7.1). Two sibling files (gp8_audio_sync.py, gp_autosync.py) already guard with an optional defusedxml import, but defusedxml isn't listed in requirements*.txt, so that guard is currently inert everywhere it's used, and most XML-parsing call sites don't attempt it at all.
Impact: A crafted GP/arrangement XML file a user chooses to import can exhaust memory/CPU on the request thread — local resource exhaustion, not data exposure.
Suggested fix: Add defusedxml to requirements and either switch the parse calls to it, or apply the same <!ENTITY rejection pattern used in feedBack-plugin-musicxml-import (see that repo's mxml2notation.py) to every XML entry point listed above.
Found during a security audit (session that produced PR #44).
Where:
lib/gp2rs.py,lib/gp2rs_gpx.py,lib/loosefolder.py,lib/song.py,lib/gp2notation.py,lib/routers/ws_highway.py:731Issue: These parse imported Guitar Pro / arrangement XML with stdlib
xml.etree.ElementTree, which Python's own docs flag as vulnerable to entity-expansion DoS (though safe from XXE/SSRF by default since 3.7.1). Two sibling files (gp8_audio_sync.py,gp_autosync.py) already guard with an optionaldefusedxmlimport, butdefusedxmlisn't listed inrequirements*.txt, so that guard is currently inert everywhere it's used, and most XML-parsing call sites don't attempt it at all.Impact: A crafted GP/arrangement XML file a user chooses to import can exhaust memory/CPU on the request thread — local resource exhaustion, not data exposure.
Suggested fix: Add
defusedxmlto requirements and either switch the parse calls to it, or apply the same<!ENTITYrejection pattern used infeedBack-plugin-musicxml-import(see that repo'smxml2notation.py) to every XML entry point listed above.