Skip to content

Fix(security): Replace ElementTree with defusedxml to prevent XXE attacks #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
orca-security-staging wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix(security): Replace ElementTree with defusedxml to prevent XXE attacks #2

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 8 additions & 10 deletions vulnerabilities/lib_oval.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,14 +125,13 @@ class OvalDocument(object):
NS_OVAL = {"oval": "http://oval.mitre.org/XMLSchema/oval-common-5"}
NS_XSI = {"xsi": "http://www.w3.org/2001/XMLSchema-instance"}

# xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
# xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5"
# xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"# xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5"
# xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
# xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd
# http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd
# http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris solaris-definitions-schema.xsd
# http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd
# http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd">^M
# http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd">

@staticmethod
def indent(elem, level=0):
Expand Down Expand Up @@ -172,7 +171,7 @@ def __init__(self, tree):
# if not tree or not isinstance(tree, ElementTree):
if not tree:
root = Element("oval_definitions")
self.tree = ElementTree.ElementTree(root)
self.tree = defusedxml.ElementTree.ElementTree(root)
element = Element("{" + OvalDocument.NS_DEFAULT.get("def") + "}generator")
gen = OvalGenerator(element)
gen.setProduct("The CIS OVAL Repository")
Expand Down Expand Up @@ -209,7 +208,7 @@ def parseFromFile(self, filename):
self.tree = None
return False
else:
self.tree = ElementTree.parse(filename)
self.tree = defusedxml.ElementTree.parse(filename)
return True
except Exception:
return False
Expand All @@ -226,8 +225,8 @@ def parseFromText(self, xmltext):
if not xmltext:
return False
else:
root = ElementTree.fromstring(xmltext)
self.tree = ElementTree(root)
root = defusedxml.ElementTree.fromstring(xmltext)
self.tree = defusedxml.ElementTree.ElementTree(root)
return True
except Exception:
return False
Expand Down Expand Up @@ -261,7 +260,7 @@ def to_string(self):
if root is None:
return ""
OvalDocument.indent(root)
return ElementTree.tostring(root, "UTF-8", "xml").decode("utf-8")
return defusedxml.ElementTree.tostring(root, "UTF-8", "xml").decode("utf-8")

def getDocumentRoot(self):
"""
Expand Down Expand Up @@ -326,8 +325,7 @@ def getDefinitions(self):
if defroot is None:
return None

element_list = list(defroot)
if not element_list:
element_list = list(defroot) if not element_list:
return None

return [OvalDefinition(element) for element in element_list]
Expand Down
Loading