Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
You might be surprised to learn that Python's built-in XML libraries are considered insecure against various kinds of attacks.
In fact, the Python documentation itself recommends the use of defusedxml for parsing untrusted XML data.
defusedxml
is an open-source, permissively licensed project that is intended as a drop-in replacement for Python's standard library XML parsers.This codemod updates all relevant uses of the standard library parsers with safe versions from
defusedxml
. It also adds thedefusedxml
dependency to your project where possible.The changes from this codemod look like this:
Dependency Updates
This codemod relies on an external dependency. However, we were unable to automatically add the dependency to your project.
This package is recommended by the Python community to protect against XML vulnerabilities.
There are a number of places where Python project dependencies can be expressed, including
setup.py
,pyproject.toml
,setup.cfg
, andrequirements.txt
files. You may need to manually add this dependency to the proper location in your project.Manual Installation
For
setup.py
:install_requires=[ + "defusedxml==0.7.1", ],
For
pyproject.toml
(usingsetuptools
):[project] dependencies = [ + "defusedxml==0.7.1", ]
For
setup.cfg
:[options] install_requires = + defusedxml==0.7.1
For
requirements.txt
:+defusedxml==0.7.1
For more information on adding dependencies to
setuptools
projects, see the setuptools documentation.If you are using another build system, please refer to the documentation for that system to determine how to add dependencies.
More reading
I have additional improvements ready for this repo! If you want to see them, leave the comment:
... and I will open a new PR right away!
Powered by: pixeebot (codemod ID: pixee:python/use-defusedxml)![](https://camo.githubusercontent.com/d44a96a9600b2037c107ef3ff5e87644dfa2d2e61cb5ea438d3a3a708838e85a/68747470733a2f2f64317a6165737361326870736d6a2e636c6f756466726f6e742e6e65742f706978656c2f76312f747261636b3f77726974654b65793d32504934336a4e6d376174597641754b37724a557a334b63643641266576656e743d445249505f505225374370697865652532467079676f617425374366313539376165663964393334303634636666376364326134643038613661626636323864356461)