From 2fb6d1f8e26f361306533e67eea2f97c46b7b349 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Mon, 9 Jun 2025 13:43:37 +0200 Subject: [PATCH 1/7] gh-127502: Update XML vulnerability table Python 3.11-3.15 include expat 2.7.1 which is not vulnerable. expat 2.6.0 was released in February 2024. --- Doc/library/xml.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index d495995398959d..4f1cfb48f1b286 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -63,12 +63,12 @@ the various modules are vulnerable to them. ========================= ================== ================== ================== ================== ================== kind sax etree minidom pulldom xmlrpc ========================= ================== ================== ================== ================== ================== -billion laughs **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) -quadratic blowup **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) **Vulnerable** (1) +billion laughs Safe (1) Safe (1) Safe (1) Safe (1) Safe (1) +quadratic blowup Safe (1) Safe (1) Safe (1) Safe (1) Safe (1) external entity expansion Safe (5) Safe (2) Safe (3) Safe (5) Safe (4) `DTD`_ retrieval Safe (5) Safe Safe Safe (5) Safe decompression bomb Safe Safe Safe Safe **Vulnerable** -large tokens **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) **Vulnerable** (6) +large tokens Safe (6) Safe (6) Safe (6) Safe (6) Safe (6) ========================= ================== ================== ================== ================== ================== 1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and From 39ba833474edf770d9feb6c5f3b5edea0241f263 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Mon, 9 Jun 2025 14:36:12 +0200 Subject: [PATCH 2/7] Remove warning and defusedxml --- Doc/library/xml.rst | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index 4f1cfb48f1b286..bfaf6b0ebe9e3d 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -15,13 +15,6 @@ XML Processing Modules Python's interfaces for processing XML are grouped in the ``xml`` package. -.. warning:: - - The XML modules are not secure against erroneous or maliciously - constructed data. If you need to parse untrusted or - unauthenticated data see the :ref:`xml-vulnerabilities` and - :ref:`defusedxml-package` sections. - It is important to note that modules in the :mod:`xml` package require that there be at least one SAX-compliant XML parser available. The Expat parser is included with Python, so the :mod:`xml.parsers.expat` module will always be @@ -126,21 +119,6 @@ large tokens be used to cause denial of service in the application parsing XML. The issue is known as :cve:`2023-52425`. -The documentation for :pypi:`defusedxml` on PyPI has further information about -all known attack vectors with examples and references. - -.. _defusedxml-package: - -The :mod:`!defusedxml` Package ------------------------------- - -:pypi:`defusedxml` is a pure Python package with modified subclasses of all stdlib -XML parsers that prevent any potentially malicious operation. Use of this -package is recommended for any server code that parses untrusted XML data. The -package also ships with example exploits and extended documentation on more -XML exploits such as XPath injection. - - .. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs .. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb .. _DTD: https://en.wikipedia.org/wiki/Document_type_definition From 9c656d332f1d6f7e4878239ead59b2d7017df2d7 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Tue, 10 Jun 2025 12:37:49 +0200 Subject: [PATCH 3/7] Replace warnings with notes Replace also "XML Vulnerabilities" with "XML Security". --- Doc/library/pyexpat.rst | 7 +++---- Doc/library/security_warnings.rst | 2 +- Doc/library/xml.dom.minidom.rst | 7 +++---- Doc/library/xml.dom.pulldom.rst | 7 +++---- Doc/library/xml.etree.elementtree.rst | 7 +++---- Doc/library/xml.rst | 7 +++---- Doc/library/xml.sax.rst | 7 +++---- Doc/library/xmlrpc.client.rst | 4 ++-- Doc/library/xmlrpc.server.rst | 4 ++-- 9 files changed, 23 insertions(+), 29 deletions(-) diff --git a/Doc/library/pyexpat.rst b/Doc/library/pyexpat.rst index 2d57cff10a9278..5506ac828e5abe 100644 --- a/Doc/library/pyexpat.rst +++ b/Doc/library/pyexpat.rst @@ -16,11 +16,10 @@ references to these attributes should be marked using the :member: role. -.. warning:: +.. note:: - The :mod:`pyexpat` module is not secure against maliciously - constructed data. If you need to parse untrusted or unauthenticated data see - :ref:`xml-vulnerabilities`. + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. .. index:: single: Expat diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst index a573c98f73eb0a..70c359cc1c0fc3 100644 --- a/Doc/library/security_warnings.rst +++ b/Doc/library/security_warnings.rst @@ -28,7 +28,7 @@ The following modules have specific security considerations: ` * :mod:`tempfile`: :ref:`mktemp is deprecated due to vulnerability to race conditions ` -* :mod:`xml`: :ref:`XML vulnerabilities ` +* :mod:`xml`: :ref:`XML security ` * :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume exhaustion ` diff --git a/Doc/library/xml.dom.minidom.rst b/Doc/library/xml.dom.minidom.rst index 00a18751207e7a..9ffedf7366a7b8 100644 --- a/Doc/library/xml.dom.minidom.rst +++ b/Doc/library/xml.dom.minidom.rst @@ -19,11 +19,10 @@ not already proficient with the DOM should consider using the :mod:`xml.etree.ElementTree` module for their XML processing instead. -.. warning:: +.. note:: - The :mod:`xml.dom.minidom` module is not secure against - maliciously constructed data. If you need to parse untrusted or - unauthenticated data see :ref:`xml-vulnerabilities`. + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. DOM applications typically start by parsing some XML into a DOM. With diff --git a/Doc/library/xml.dom.pulldom.rst b/Doc/library/xml.dom.pulldom.rst index fd96765cbe3c96..8bceeecd46393e 100644 --- a/Doc/library/xml.dom.pulldom.rst +++ b/Doc/library/xml.dom.pulldom.rst @@ -19,11 +19,10 @@ responsible for explicitly pulling events from the stream, looping over those events until either processing is finished or an error condition occurs. -.. warning:: +.. note:: - The :mod:`xml.dom.pulldom` module is not secure against - maliciously constructed data. If you need to parse untrusted or - unauthenticated data see :ref:`xml-vulnerabilities`. + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. .. versionchanged:: 3.7.1 diff --git a/Doc/library/xml.etree.elementtree.rst b/Doc/library/xml.etree.elementtree.rst index 1daf6628013bf0..00075ac2a23e6b 100644 --- a/Doc/library/xml.etree.elementtree.rst +++ b/Doc/library/xml.etree.elementtree.rst @@ -20,11 +20,10 @@ for parsing and creating XML data. The :mod:`!xml.etree.cElementTree` module is deprecated. -.. warning:: +.. note:: - The :mod:`xml.etree.ElementTree` module is not secure against - maliciously constructed data. If you need to parse untrusted or - unauthenticated data see :ref:`xml-vulnerabilities`. + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. Tutorial -------- diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index bfaf6b0ebe9e3d..01f4d10bd8f656 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -40,12 +40,11 @@ The XML handling submodules are: * :mod:`xml.parsers.expat`: the Expat parser binding -.. _xml-vulnerabilities: +.. _xml-security: -XML vulnerabilities -------------------- +XML security +------------ -The XML processing modules are not secure against maliciously constructed data. An attacker can abuse XML features to carry out denial of service attacks, access local files, generate network connections to other machines, or circumvent firewalls. diff --git a/Doc/library/xml.sax.rst b/Doc/library/xml.sax.rst index c60e9e505f7544..5fa92645a440ce 100644 --- a/Doc/library/xml.sax.rst +++ b/Doc/library/xml.sax.rst @@ -18,11 +18,10 @@ SAX exceptions and the convenience functions which will be most used by users of the SAX API. -.. warning:: +.. note:: - The :mod:`xml.sax` module is not secure against maliciously - constructed data. If you need to parse untrusted or unauthenticated data see - :ref:`xml-vulnerabilities`. + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. .. versionchanged:: 3.7.1 diff --git a/Doc/library/xmlrpc.client.rst b/Doc/library/xmlrpc.client.rst index 654154cb43d6e5..547cb50be78a78 100644 --- a/Doc/library/xmlrpc.client.rst +++ b/Doc/library/xmlrpc.client.rst @@ -24,8 +24,8 @@ between conformable Python objects and XML on the wire. .. warning:: The :mod:`xmlrpc.client` module is not secure against maliciously - constructed data. If you need to parse untrusted or unauthenticated data see - :ref:`xml-vulnerabilities`. + constructed data. If you need to parse untrusted or unauthenticated data, + see :ref:`xml-security`. .. versionchanged:: 3.5 diff --git a/Doc/library/xmlrpc.server.rst b/Doc/library/xmlrpc.server.rst index 06169c7eca8b0c..2a8f6f8d5fc0de 100644 --- a/Doc/library/xmlrpc.server.rst +++ b/Doc/library/xmlrpc.server.rst @@ -20,8 +20,8 @@ servers written in Python. Servers can either be free standing, using .. warning:: The :mod:`xmlrpc.server` module is not secure against maliciously - constructed data. If you need to parse untrusted or unauthenticated data see - :ref:`xml-vulnerabilities`. + constructed data. If you need to parse untrusted or unauthenticated data, + see :ref:`xml-security`. .. include:: ../includes/wasm-notavail.rst From 4a26d9d34f7b6c8e7e9d08e8fd2085571679f178 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Tue, 10 Jun 2025 12:42:05 +0200 Subject: [PATCH 4/7] Restore XML note --- Doc/library/xml.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index 01f4d10bd8f656..07bc793f504953 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -15,6 +15,11 @@ XML Processing Modules Python's interfaces for processing XML are grouped in the ``xml`` package. +.. note:: + + If you need to parse untrusted or unauthenticated data, see + :ref:`xml-security`. + It is important to note that modules in the :mod:`xml` package require that there be at least one SAX-compliant XML parser available. The Expat parser is included with Python, so the :mod:`xml.parsers.expat` module will always be From 933b732fdc86024f4e47b5c8485a0ce7ec5dbbfa Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Tue, 1 Jul 2025 15:29:46 +0200 Subject: [PATCH 5/7] Remove the table --- Doc/library/xml.rst | 49 ++++++++------------------------------------- 1 file changed, 8 insertions(+), 41 deletions(-) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index 07bc793f504953..f651d1ac122d21 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -54,37 +54,15 @@ An attacker can abuse XML features to carry out denial of service attacks, access local files, generate network connections to other machines, or circumvent firewalls. -The following table gives an overview of the known attacks and whether -the various modules are vulnerable to them. - -========================= ================== ================== ================== ================== ================== -kind sax etree minidom pulldom xmlrpc -========================= ================== ================== ================== ================== ================== -billion laughs Safe (1) Safe (1) Safe (1) Safe (1) Safe (1) -quadratic blowup Safe (1) Safe (1) Safe (1) Safe (1) Safe (1) -external entity expansion Safe (5) Safe (2) Safe (3) Safe (5) Safe (4) -`DTD`_ retrieval Safe (5) Safe Safe Safe (5) Safe -decompression bomb Safe Safe Safe Safe **Vulnerable** -large tokens Safe (6) Safe (6) Safe (6) Safe (6) Safe (6) -========================= ================== ================== ================== ================== ================== - -1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and - "quadratic blowup" vulnerabilities. Items still listed as vulnerable due to - potential reliance on system-provided libraries. Check - :const:`!pyexpat.EXPAT_VERSION`. -2. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a - :exc:`~xml.etree.ElementTree.ParseError` when an entity occurs. -3. :mod:`xml.dom.minidom` doesn't expand external entities and simply returns - the unexpanded entity verbatim. -4. :mod:`xmlrpc.client` doesn't expand external entities and omits them. -5. Since Python 3.7.1, external general entities are no longer processed by - default. -6. Expat 2.6.0 and newer is not vulnerable to denial of service - through quadratic runtime caused by parsing large tokens. - Items still listed as vulnerable due to - potential reliance on system-provided libraries. Check - :const:`!pyexpat.EXPAT_VERSION`. +Expat versions lower that 2.6.0 may be vulnerable to "billion laughs", +"quadratic blowup" and "large tokens". Python may be vulnerable if it uses such +older versions of Expat as a system-provided library, it may be vulnerable. +Check :const:`!pyexpat.EXPAT_VERSION`. +xmlrpc is **vulnerable** to "decompression bomb". + +Since Python 3.7.1, external general entities are no longer processed by +default. billion laughs / exponential entity expansion The `Billion Laughs`_ attack -- also known as exponential entity expansion -- @@ -100,16 +78,6 @@ quadratic blowup entity expansion efficient as the exponential case but it avoids triggering parser countermeasures that forbid deeply nested entities. -external entity expansion - Entity declarations can contain more than just text for replacement. They can - also point to external resources or local files. The XML - parser accesses the resource and embeds the content into the XML document. - -`DTD`_ retrieval - Some XML libraries like Python's :mod:`xml.dom.pulldom` retrieve document type - definitions from remote or local locations. The feature has similar - implications as the external entity expansion issue. - decompression bomb Decompression bombs (aka `ZIP bomb`_) apply to all XML libraries that can parse compressed XML streams such as gzipped HTTP streams or @@ -125,4 +93,3 @@ large tokens .. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs .. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb -.. _DTD: https://en.wikipedia.org/wiki/Document_type_definition From 093514f6de4ea0449a0867208b924ec4da61f9fb Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Wed, 2 Jul 2025 14:41:39 +0200 Subject: [PATCH 6/7] Keep old anchor (xml-vulnerabilities) --- Doc/library/xml.rst | 1 + 1 file changed, 1 insertion(+) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index f651d1ac122d21..7e358eeb087f86 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -46,6 +46,7 @@ The XML handling submodules are: .. _xml-security: +.. _xml-vulnerabilities: XML security ------------ From 4ad735638b6556efe5aedfdfe4e1c55735def126 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Wed, 2 Jul 2025 15:43:55 +0200 Subject: [PATCH 7/7] Apply suggestions from code review Co-authored-by: Petr Viktorin --- Doc/library/xml.rst | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst index 7e358eeb087f86..28465219a1ac18 100644 --- a/Doc/library/xml.rst +++ b/Doc/library/xml.rst @@ -57,13 +57,11 @@ circumvent firewalls. Expat versions lower that 2.6.0 may be vulnerable to "billion laughs", "quadratic blowup" and "large tokens". Python may be vulnerable if it uses such -older versions of Expat as a system-provided library, it may be vulnerable. +older versions of Expat as a system-provided library. Check :const:`!pyexpat.EXPAT_VERSION`. -xmlrpc is **vulnerable** to "decompression bomb". +:mod:`xmlrpc` is **vulnerable** to the "decompression bomb" attack. -Since Python 3.7.1, external general entities are no longer processed by -default. billion laughs / exponential entity expansion The `Billion Laughs`_ attack -- also known as exponential entity expansion --