Skip to content

Files

Latest commit

 

History

History
43 lines (28 loc) · 1.37 KB

B320.md

File metadata and controls

43 lines (28 loc) · 1.37 KB

Pattern: Use of insecure lxml.etree module

Issue: -

Description

This module is not secure against maliciously constructed data. Use defusedxml package instead.

The results of an attack on a vulnerable XML library can be fairly dramatic. With just a few hundred Bytes of XML data an attacker can occupy several Gigabytes of memory within seconds. An attacker can also keep CPUs busy for a long time with a small to medium size request. Under some circumstances it is even possible to access local files on your server, to circumvent a firewall, or to abuse services to rebound attacks to third parties.

This rule checks for the following calls:

  • lxml.etree.parse
  • lxml.etree.fromstring
  • lxml.etree.RestrictedElement
  • lxml.etree.GlobalParserTLS
  • lxml.etree.getDefaultParser
  • lxml.etree.check_docinfo

Example of insecure code:

import lxml.etree
import lxml

xmlString = "<note>malicious data</note>"
root = lxml.etree.fromstring(xmlString)

Example of secure code:

from defusedxml.lxml import fromstring

xmlString = "<note>malicious data</note>"
root = fromstring(xmlString)

Further Reading