@@ -60,22 +60,26 @@ circumvent firewalls.
6060The following table gives an overview of the known attacks and whether
6161the various modules are vulnerable to them.
6262
63- ========================= ============== =============== ============== ============== ==============
64- kind sax etree minidom pulldom xmlrpc
65- ========================= ============== =============== ============== ============== ==============
66- billion laughs **Vulnerable ** **Vulnerable ** **Vulnerable ** **Vulnerable ** **Vulnerable **
67- quadratic blowup **Vulnerable ** **Vulnerable ** **Vulnerable ** **Vulnerable ** **Vulnerable **
68- external entity expansion Safe (4) Safe (1) Safe (2) Safe (4) Safe (3)
69- `DTD `_ retrieval Safe (4) Safe Safe Safe (4) Safe
70- decompression bomb Safe Safe Safe Safe **Vulnerable **
71- ========================= ============== =============== ============== ============== ==============
72-
73- 1. :mod: `xml.etree.ElementTree ` doesn't expand external entities and raises a
63+ ========================= ================== ================== ================== ================== ==================
64+ kind sax etree minidom pulldom xmlrpc
65+ ========================= ================== ================== ================== ================== ==================
66+ billion laughs **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1)
67+ quadratic blowup **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1) **Vulnerable ** (1)
68+ external entity expansion Safe (5) Safe (2) Safe (3) Safe (5) Safe (4)
69+ `DTD `_ retrieval Safe (5) Safe Safe Safe (5) Safe
70+ decompression bomb Safe Safe Safe Safe **Vulnerable **
71+ ========================= ================== ================== ================== ================== ==================
72+
73+ 1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and
74+ "quadratic blowup" vulnerabilities. Items still listed as vulnerable due to
75+ potential reliance on system-provided libraries. Check
76+ :data: `pyexpat.EXPAT_VERSION `.
77+ 2. :mod: `xml.etree.ElementTree ` doesn't expand external entities and raises a
7478 :exc: `ParserError ` when an entity occurs.
75- 2 . :mod: `xml.dom.minidom ` doesn't expand external entities and simply returns
79+ 3 . :mod: `xml.dom.minidom ` doesn't expand external entities and simply returns
7680 the unexpanded entity verbatim.
77- 3 . :mod: `xmlrpclib ` doesn't expand external entities and omits them.
78- 4 . Since Python 3.7.1, external general entities are no longer processed by
81+ 4 . :mod: `xmlrpclib ` doesn't expand external entities and omits them.
82+ 5 . Since Python 3.7.1, external general entities are no longer processed by
7983 default.
8084
8185
0 commit comments