Skip to content

Use defusedxml to guard against various XML vulnerabilities

Bitbucket Importer requested to merge bitbucket/merged-pr-300 into branch/2.5

Created originally on Bitbucket by alexander_maykin (Alexander Schrijver)

Was already merged in Bitbucket before import, marked as merged by the import user

  • Test for various XML vulnerabilities

    Add tests which show that Quadratic blowup and Billion laughs attacks are possible for openpyxl. Add tests which test for the regression of XXE-attacks for local or remote files.

  • Use defusedxml for lxml and xml.etree.(c)Elementree to guard against the billion laughs attack and quadratic blowup attack.

Merge request reports