Pattern: Use of insecure xml.sax module
Issue: -
This module is not secure against maliciously constructed data. Use defusedxml package instead.
The results of an attack on a vulnerable XML library can be fairly dramatic. With just a few hundred Bytes of XML data an attacker can occupy several Gigabytes of memory within seconds. An attacker can also keep CPUs busy for a long time with a small to medium size request. Under some circumstances it is even possible to access local files on your server, to circumvent a firewall, or to abuse services to rebound attacks to third parties.
This rule checks for the following calls:
xml.sax.parsexml.sax.parseStringxml.sax.make_parser
Example of insecure code:
import xml.sax
from xml import sax
xml.sax.make_parser()Example of secure code:
import defusedxml.sax
defusedxml.sax.make_parser()