Home Original page

bpo-17239: Disable external entities in SAX parser by tiran · Pull Request #9217 · python/cpython

vstinner

vstinner

@tiran 

The xml.sax and xml.dom.minidom parsers no longer processes external
entities to increase security. Before, the parser created network
connections to fetch remote files or loaded local files from the file
system for DTD and entities.

Signed-off-by: Christian Heimes <christian@python.org>

tiran added a commit to tiran/cpython that referenced this pull request

Sep 23, 2018 
The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <christian@python.org>

tiran added a commit to tiran/cpython that referenced this pull request

Sep 23, 2018 
The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <christian@python.org>

miss-islington pushed a commit that referenced this pull request

Sep 24, 2018 
…H-9512)

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue17239

miss-islington pushed a commit that referenced this pull request

Sep 24, 2018 
…H-9511)

The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d)

Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue17239