Use defusedxml to guard against various XML vulnerabilities

Created originally on Bitbucket by alexander_maykin (Alexander Schrijver)

Was already merged in Bitbucket before import, marked as merged by the import user

  • Test for various XML vulnerabilities

    Add tests which show that Quadratic blowup and Billion laughs attacks are possible for openpyxl. Add tests which test for the regression of XXE-attacks for local or remote files.

  • Use defusedxml for lxml and xml.etree.(c)Elementree to guard against the billion laughs attack and quadratic blowup attack.

Merge request reports

Loading