Linux cpanel.rrshost.in 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64
Apache
: 109.123.238.221 | : 172.69.7.25
128 Domain
8.2.28
aev999
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
HASH IDENTIFIER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
python2.7 /
html /
_sources /
library /
[ HOME SHELL ]
Name
Size
Permission
Action
2to3.rst.txt
14.3
KB
-rw-r--r--
__builtin__.rst.txt
1.46
KB
-rw-r--r--
__future__.rst.txt
4.84
KB
-rw-r--r--
__main__.rst.txt
535
B
-rw-r--r--
_winreg.rst.txt
22.77
KB
-rw-r--r--
abc.rst.txt
7.05
KB
-rw-r--r--
aepack.rst.txt
4.16
KB
-rw-r--r--
aetools.rst.txt
3.45
KB
-rw-r--r--
aetypes.rst.txt
4.16
KB
-rw-r--r--
aifc.rst.txt
6.92
KB
-rw-r--r--
al.rst.txt
5.18
KB
-rw-r--r--
allos.rst.txt
695
B
-rw-r--r--
anydbm.rst.txt
4.01
KB
-rw-r--r--
archiving.rst.txt
424
B
-rw-r--r--
argparse.rst.txt
72.93
KB
-rw-r--r--
array.rst.txt
10.28
KB
-rw-r--r--
ast.rst.txt
10.23
KB
-rw-r--r--
asynchat.rst.txt
8.99
KB
-rw-r--r--
asyncore.rst.txt
12.63
KB
-rw-r--r--
atexit.rst.txt
3.82
KB
-rw-r--r--
audioop.rst.txt
10.15
KB
-rw-r--r--
autogil.rst.txt
1015
B
-rw-r--r--
base64.rst.txt
6.11
KB
-rw-r--r--
basehttpserver.rst.txt
10.16
KB
-rw-r--r--
bastion.rst.txt
2.55
KB
-rw-r--r--
bdb.rst.txt
12.16
KB
-rw-r--r--
binascii.rst.txt
6.36
KB
-rw-r--r--
binhex.rst.txt
1.87
KB
-rw-r--r--
bisect.rst.txt
5.29
KB
-rw-r--r--
bsddb.rst.txt
7.4
KB
-rw-r--r--
bz2.rst.txt
7.88
KB
-rw-r--r--
calendar.rst.txt
11.02
KB
-rw-r--r--
carbon.rst.txt
15.58
KB
-rw-r--r--
cd.rst.txt
11.69
KB
-rw-r--r--
cgi.rst.txt
22.32
KB
-rw-r--r--
cgihttpserver.rst.txt
2.72
KB
-rw-r--r--
cgitb.rst.txt
2.81
KB
-rw-r--r--
chunk.rst.txt
4.84
KB
-rw-r--r--
cmath.rst.txt
7.47
KB
-rw-r--r--
cmd.rst.txt
8.36
KB
-rw-r--r--
code.rst.txt
6.95
KB
-rw-r--r--
codecs.rst.txt
65.4
KB
-rw-r--r--
codeop.rst.txt
3.69
KB
-rw-r--r--
collections.rst.txt
40.48
KB
-rw-r--r--
colorpicker.rst.txt
913
B
-rw-r--r--
colorsys.rst.txt
1.78
KB
-rw-r--r--
commands.rst.txt
2.53
KB
-rw-r--r--
compileall.rst.txt
4.57
KB
-rw-r--r--
compiler.rst.txt
36.59
KB
-rw-r--r--
configparser.rst.txt
19.15
KB
-rw-r--r--
constants.rst.txt
2.27
KB
-rw-r--r--
contextlib.rst.txt
5.87
KB
-rw-r--r--
cookie.rst.txt
9.32
KB
-rw-r--r--
cookielib.rst.txt
27.22
KB
-rw-r--r--
copy.rst.txt
3.27
KB
-rw-r--r--
copy_reg.rst.txt
2.27
KB
-rw-r--r--
crypt.rst.txt
2.24
KB
-rw-r--r--
crypto.rst.txt
355
B
-rw-r--r--
csv.rst.txt
22.22
KB
-rw-r--r--
ctypes.rst.txt
88.39
KB
-rw-r--r--
curses.ascii.rst.txt
8.83
KB
-rw-r--r--
curses.panel.rst.txt
2.68
KB
-rw-r--r--
curses.rst.txt
73.12
KB
-rw-r--r--
custominterp.rst.txt
570
B
-rw-r--r--
datatypes.rst.txt
864
B
-rw-r--r--
datetime.rst.txt
72.93
KB
-rw-r--r--
dbhash.rst.txt
3.77
KB
-rw-r--r--
dbm.rst.txt
3.04
KB
-rw-r--r--
debug.rst.txt
446
B
-rw-r--r--
decimal.rst.txt
69.26
KB
-rw-r--r--
development.rst.txt
640
B
-rw-r--r--
difflib.rst.txt
30
KB
-rw-r--r--
dircache.rst.txt
1.77
KB
-rw-r--r--
dis.rst.txt
22.7
KB
-rw-r--r--
distribution.rst.txt
426
B
-rw-r--r--
distutils.rst.txt
1.91
KB
-rw-r--r--
dl.rst.txt
3.31
KB
-rw-r--r--
doctest.rst.txt
72.25
KB
-rw-r--r--
docxmlrpcserver.rst.txt
3.71
KB
-rw-r--r--
dumbdbm.rst.txt
2.77
KB
-rw-r--r--
dummy_thread.rst.txt
1.03
KB
-rw-r--r--
dummy_threading.rst.txt
799
B
-rw-r--r--
easydialogs.rst.txt
10.1
KB
-rw-r--r--
email-examples.rst.txt
1.24
KB
-rw-r--r--
email.charset.rst.txt
9.43
KB
-rw-r--r--
email.encoders.rst.txt
2.32
KB
-rw-r--r--
email.errors.rst.txt
3.91
KB
-rw-r--r--
email.generator.rst.txt
5.99
KB
-rw-r--r--
email.header.rst.txt
7.35
KB
-rw-r--r--
email.iterators.rst.txt
2.36
KB
-rw-r--r--
email.message.rst.txt
24.63
KB
-rw-r--r--
email.mime.rst.txt
9.68
KB
-rw-r--r--
email.parser.rst.txt
10.08
KB
-rw-r--r--
email.rst.txt
15.73
KB
-rw-r--r--
email.utils.rst.txt
6.32
KB
-rw-r--r--
ensurepip.rst.txt
4.9
KB
-rw-r--r--
errno.rst.txt
6.55
KB
-rw-r--r--
exceptions.rst.txt
18.03
KB
-rw-r--r--
fcntl.rst.txt
7.19
KB
-rw-r--r--
filecmp.rst.txt
5.22
KB
-rw-r--r--
fileformats.rst.txt
302
B
-rw-r--r--
fileinput.rst.txt
7.24
KB
-rw-r--r--
filesys.rst.txt
806
B
-rw-r--r--
fl.rst.txt
17.23
KB
-rw-r--r--
fm.rst.txt
2.64
KB
-rw-r--r--
fnmatch.rst.txt
3.03
KB
-rw-r--r--
formatter.rst.txt
12.93
KB
-rw-r--r--
fpectl.rst.txt
4.07
KB
-rw-r--r--
fpformat.rst.txt
1.71
KB
-rw-r--r--
fractions.rst.txt
5.17
KB
-rw-r--r--
framework.rst.txt
11.18
KB
-rw-r--r--
frameworks.rst.txt
378
B
-rw-r--r--
ftplib.rst.txt
15.35
KB
-rw-r--r--
functions.rst.txt
73.75
KB
-rw-r--r--
functools.rst.txt
7.27
KB
-rw-r--r--
future_builtins.rst.txt
1.96
KB
-rw-r--r--
gc.rst.txt
8.8
KB
-rw-r--r--
gdbm.rst.txt
4.77
KB
-rw-r--r--
gensuitemodule.rst.txt
3.04
KB
-rw-r--r--
getopt.rst.txt
6.51
KB
-rw-r--r--
getpass.rst.txt
1.83
KB
-rw-r--r--
gettext.rst.txt
28.36
KB
-rw-r--r--
gl.rst.txt
5.87
KB
-rw-r--r--
glob.rst.txt
2.36
KB
-rw-r--r--
grp.rst.txt
2.2
KB
-rw-r--r--
gzip.rst.txt
4.71
KB
-rw-r--r--
hashlib.rst.txt
7.21
KB
-rw-r--r--
heapq.rst.txt
12.88
KB
-rw-r--r--
hmac.rst.txt
3
KB
-rw-r--r--
hotshot.rst.txt
4.19
KB
-rw-r--r--
htmllib.rst.txt
7.21
KB
-rw-r--r--
htmlparser.rst.txt
11.37
KB
-rw-r--r--
httplib.rst.txt
36.58
KB
-rw-r--r--
i18n.rst.txt
409
B
-rw-r--r--
ic.rst.txt
4.89
KB
-rw-r--r--
idle.rst.txt
21.66
KB
-rw-r--r--
imageop.rst.txt
3.91
KB
-rw-r--r--
imaplib.rst.txt
16.82
KB
-rw-r--r--
imgfile.rst.txt
2.7
KB
-rw-r--r--
imghdr.rst.txt
2.57
KB
-rw-r--r--
imp.rst.txt
12.3
KB
-rw-r--r--
importlib.rst.txt
1.1
KB
-rw-r--r--
imputil.rst.txt
6.86
KB
-rw-r--r--
index.rst.txt
2.23
KB
-rw-r--r--
inspect.rst.txt
27.49
KB
-rw-r--r--
internet.rst.txt
950
B
-rw-r--r--
intro.rst.txt
2.74
KB
-rw-r--r--
io.rst.txt
38.11
KB
-rw-r--r--
ipc.rst.txt
630
B
-rw-r--r--
itertools.rst.txt
35.67
KB
-rw-r--r--
jpeg.rst.txt
3.77
KB
-rw-r--r--
json.rst.txt
24.95
KB
-rw-r--r--
keyword.rst.txt
617
B
-rw-r--r--
language.rst.txt
523
B
-rw-r--r--
linecache.rst.txt
1.84
KB
-rw-r--r--
locale.rst.txt
24.39
KB
-rw-r--r--
logging.config.rst.txt
30.82
KB
-rw-r--r--
logging.handlers.rst.txt
27.49
KB
-rw-r--r--
logging.rst.txt
45.78
KB
-rw-r--r--
mac.rst.txt
791
B
-rw-r--r--
macos.rst.txt
3.73
KB
-rw-r--r--
macosa.rst.txt
3.87
KB
-rw-r--r--
macostools.rst.txt
3.92
KB
-rw-r--r--
macpath.rst.txt
650
B
-rw-r--r--
mailbox.rst.txt
66.53
KB
-rw-r--r--
mailcap.rst.txt
3.59
KB
-rw-r--r--
markup.rst.txt
1.22
KB
-rw-r--r--
marshal.rst.txt
5.56
KB
-rw-r--r--
math.rst.txt
10.66
KB
-rw-r--r--
md5.rst.txt
2.75
KB
-rw-r--r--
mhlib.rst.txt
3.87
KB
-rw-r--r--
mimetools.rst.txt
4.4
KB
-rw-r--r--
mimetypes.rst.txt
9.61
KB
-rw-r--r--
mimewriter.rst.txt
3.28
KB
-rw-r--r--
mimify.rst.txt
3.44
KB
-rw-r--r--
miniaeframe.rst.txt
2.5
KB
-rw-r--r--
misc.rst.txt
248
B
-rw-r--r--
mm.rst.txt
447
B
-rw-r--r--
mmap.rst.txt
10.24
KB
-rw-r--r--
modulefinder.rst.txt
3.3
KB
-rw-r--r--
modules.rst.txt
382
B
-rw-r--r--
msilib.rst.txt
18.62
KB
-rw-r--r--
msvcrt.rst.txt
4.24
KB
-rw-r--r--
multifile.rst.txt
6.46
KB
-rw-r--r--
multiprocessing.rst.txt
90.45
KB
-rw-r--r--
mutex.rst.txt
1.89
KB
-rw-r--r--
netdata.rst.txt
432
B
-rw-r--r--
netrc.rst.txt
3.05
KB
-rw-r--r--
new.rst.txt
2.59
KB
-rw-r--r--
nis.rst.txt
2.06
KB
-rw-r--r--
nntplib.rst.txt
14.19
KB
-rw-r--r--
numbers.rst.txt
7.82
KB
-rw-r--r--
numeric.rst.txt
751
B
-rw-r--r--
operator.rst.txt
21.57
KB
-rw-r--r--
optparse.rst.txt
75.29
KB
-rw-r--r--
os.path.rst.txt
12.79
KB
-rw-r--r--
os.rst.txt
80.64
KB
-rw-r--r--
ossaudiodev.rst.txt
16.9
KB
-rw-r--r--
othergui.rst.txt
2.66
KB
-rw-r--r--
parser.rst.txt
15.02
KB
-rw-r--r--
pdb.rst.txt
15.67
KB
-rw-r--r--
persistence.rst.txt
826
B
-rw-r--r--
pickle.rst.txt
36.39
KB
-rw-r--r--
pickletools.rst.txt
1.95
KB
-rw-r--r--
pipes.rst.txt
3.7
KB
-rw-r--r--
pkgutil.rst.txt
7.53
KB
-rw-r--r--
platform.rst.txt
9.33
KB
-rw-r--r--
plistlib.rst.txt
4.04
KB
-rw-r--r--
popen2.rst.txt
6.86
KB
-rw-r--r--
poplib.rst.txt
6.07
KB
-rw-r--r--
posix.rst.txt
3.54
KB
-rw-r--r--
posixfile.rst.txt
7.03
KB
-rw-r--r--
pprint.rst.txt
8.86
KB
-rw-r--r--
profile.rst.txt
27.99
KB
-rw-r--r--
pty.rst.txt
1.72
KB
-rw-r--r--
pwd.rst.txt
2.66
KB
-rw-r--r--
py_compile.rst.txt
2.42
KB
-rw-r--r--
pyclbr.rst.txt
3.22
KB
-rw-r--r--
pydoc.rst.txt
3.99
KB
-rw-r--r--
pyexpat.rst.txt
28.21
KB
-rw-r--r--
python.rst.txt
514
B
-rw-r--r--
queue.rst.txt
6.87
KB
-rw-r--r--
quopri.rst.txt
2.61
KB
-rw-r--r--
random.rst.txt
13.01
KB
-rw-r--r--
re.rst.txt
53.81
KB
-rw-r--r--
readline.rst.txt
10.27
KB
-rw-r--r--
repr.rst.txt
4.61
KB
-rw-r--r--
resource.rst.txt
9.37
KB
-rw-r--r--
restricted.rst.txt
3.25
KB
-rw-r--r--
rexec.rst.txt
11.47
KB
-rw-r--r--
rfc822.rst.txt
13.71
KB
-rw-r--r--
rlcompleter.rst.txt
2.44
KB
-rw-r--r--
robotparser.rst.txt
2.14
KB
-rw-r--r--
runpy.rst.txt
6.78
KB
-rw-r--r--
sched.rst.txt
4.54
KB
-rw-r--r--
scrolledtext.rst.txt
1.35
KB
-rw-r--r--
select.rst.txt
20.26
KB
-rw-r--r--
sets.rst.txt
14.62
KB
-rw-r--r--
sgi.rst.txt
322
B
-rw-r--r--
sgmllib.rst.txt
10.41
KB
-rw-r--r--
sha.rst.txt
2.74
KB
-rw-r--r--
shelve.rst.txt
8.12
KB
-rw-r--r--
shlex.rst.txt
11.05
KB
-rw-r--r--
shutil.rst.txt
13.17
KB
-rw-r--r--
signal.rst.txt
10.47
KB
-rw-r--r--
simplehttpserver.rst.txt
4.45
KB
-rw-r--r--
simplexmlrpcserver.rst.txt
10.63
KB
-rw-r--r--
site.rst.txt
7.7
KB
-rw-r--r--
smtpd.rst.txt
2.41
KB
-rw-r--r--
smtplib.rst.txt
14.56
KB
-rw-r--r--
sndhdr.rst.txt
1.72
KB
-rw-r--r--
socket.rst.txt
39.81
KB
-rw-r--r--
socketserver.rst.txt
21.98
KB
-rw-r--r--
someos.rst.txt
599
B
-rw-r--r--
spwd.rst.txt
2.76
KB
-rw-r--r--
sqlite3.rst.txt
34.62
KB
-rw-r--r--
ssl.rst.txt
74.91
KB
-rw-r--r--
stat.rst.txt
7.6
KB
-rw-r--r--
statvfs.rst.txt
1.27
KB
-rw-r--r--
stdtypes.rst.txt
119.78
KB
-rw-r--r--
string.rst.txt
43.05
KB
-rw-r--r--
stringio.rst.txt
4.07
KB
-rw-r--r--
stringprep.rst.txt
4.14
KB
-rw-r--r--
strings.rst.txt
746
B
-rw-r--r--
struct.rst.txt
16.7
KB
-rw-r--r--
subprocess.rst.txt
32.86
KB
-rw-r--r--
sun.rst.txt
249
B
-rw-r--r--
sunau.rst.txt
6.96
KB
-rw-r--r--
sunaudio.rst.txt
5.71
KB
-rw-r--r--
symbol.rst.txt
975
B
-rw-r--r--
symtable.rst.txt
4.95
KB
-rw-r--r--
sys.rst.txt
46.4
KB
-rw-r--r--
sysconfig.rst.txt
7.46
KB
-rw-r--r--
syslog.rst.txt
3.84
KB
-rw-r--r--
tabnanny.rst.txt
1.95
KB
-rw-r--r--
tarfile.rst.txt
27.55
KB
-rw-r--r--
telnetlib.rst.txt
7.31
KB
-rw-r--r--
tempfile.rst.txt
10.26
KB
-rw-r--r--
termios.rst.txt
3.65
KB
-rw-r--r--
test.rst.txt
17.34
KB
-rw-r--r--
textwrap.rst.txt
8.47
KB
-rw-r--r--
thread.rst.txt
6.43
KB
-rw-r--r--
threading.rst.txt
31.77
KB
-rw-r--r--
time.rst.txt
25.41
KB
-rw-r--r--
timeit.rst.txt
11.33
KB
-rw-r--r--
tix.rst.txt
22.16
KB
-rw-r--r--
tk.rst.txt
1.57
KB
-rw-r--r--
tkinter.rst.txt
32.72
KB
-rw-r--r--
token.rst.txt
2.39
KB
-rw-r--r--
tokenize.rst.txt
5.44
KB
-rw-r--r--
trace.rst.txt
6.57
KB
-rw-r--r--
traceback.rst.txt
10.46
KB
-rw-r--r--
ttk.rst.txt
56.07
KB
-rw-r--r--
tty.rst.txt
1011
B
-rw-r--r--
turtle.rst.txt
62.59
KB
-rw-r--r--
types.rst.txt
6.05
KB
-rw-r--r--
undoc.rst.txt
6.4
KB
-rw-r--r--
unicodedata.rst.txt
5.59
KB
-rw-r--r--
unittest.rst.txt
81.01
KB
-rw-r--r--
unix.rst.txt
490
B
-rw-r--r--
urllib.rst.txt
24.38
KB
-rw-r--r--
urllib2.rst.txt
34.39
KB
-rw-r--r--
urlparse.rst.txt
16.56
KB
-rw-r--r--
user.rst.txt
2.68
KB
-rw-r--r--
userdict.rst.txt
9.07
KB
-rw-r--r--
uu.rst.txt
2.31
KB
-rw-r--r--
uuid.rst.txt
8.18
KB
-rw-r--r--
warnings.rst.txt
19.6
KB
-rw-r--r--
wave.rst.txt
4.93
KB
-rw-r--r--
weakref.rst.txt
12.62
KB
-rw-r--r--
webbrowser.rst.txt
9.63
KB
-rw-r--r--
whichdb.rst.txt
931
B
-rw-r--r--
windows.rst.txt
273
B
-rw-r--r--
winsound.rst.txt
4.95
KB
-rw-r--r--
wsgiref.rst.txt
29.85
KB
-rw-r--r--
xdrlib.rst.txt
7.89
KB
-rw-r--r--
xml.dom.minidom.rst.txt
10.95
KB
-rw-r--r--
xml.dom.pulldom.rst.txt
1.53
KB
-rw-r--r--
xml.dom.rst.txt
39.24
KB
-rw-r--r--
xml.etree.elementtree.rst.txt
34.87
KB
-rw-r--r--
xml.rst.txt
5.95
KB
-rw-r--r--
xml.sax.handler.rst.txt
15.01
KB
-rw-r--r--
xml.sax.reader.rst.txt
11.97
KB
-rw-r--r--
xml.sax.rst.txt
6.31
KB
-rw-r--r--
xml.sax.utils.rst.txt
3.48
KB
-rw-r--r--
xmlrpclib.rst.txt
22.03
KB
-rw-r--r--
zipfile.rst.txt
18.43
KB
-rw-r--r--
zipimport.rst.txt
5.82
KB
-rw-r--r--
zlib.rst.txt
12.47
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : xml.rst.txt
.. _xml: XML Processing Modules ====================== .. module:: xml :synopsis: Package containing XML processing modules .. sectionauthor:: Christian Heimes <christian@python.org> .. sectionauthor:: Georg Brandl <georg@python.org> Python's interfaces for processing XML are grouped in the ``xml`` package. .. warning:: The XML modules are not secure against erroneous or maliciously constructed data. If you need to parse untrusted or unauthenticated data see :ref:`xml-vulnerabilities`. It is important to note that modules in the :mod:`xml` package require that there be at least one SAX-compliant XML parser available. The Expat parser is included with Python, so the :mod:`xml.parsers.expat` module will always be available. The documentation for the :mod:`xml.dom` and :mod:`xml.sax` packages are the definition of the Python bindings for the DOM and SAX interfaces. The XML handling submodules are: * :mod:`xml.etree.ElementTree`: the ElementTree API, a simple and lightweight XML processor .. * :mod:`xml.dom`: the DOM API definition * :mod:`xml.dom.minidom`: a minimal DOM implementation * :mod:`xml.dom.pulldom`: support for building partial DOM trees .. * :mod:`xml.sax`: SAX2 base classes and convenience functions * :mod:`xml.parsers.expat`: the Expat parser binding .. _xml-vulnerabilities: XML vulnerabilities =================== The XML processing modules are not secure against maliciously constructed data. An attacker can abuse vulnerabilities for e.g. denial of service attacks, to access local files, to generate network connections to other machines, or to or circumvent firewalls. The attacks on XML abuse unfamiliar features like inline `DTD`_ (document type definition) with entities. The following table gives an overview of the known attacks and if the various modules are vulnerable to them. ========================= ============== =============== ============== ============== ============== kind sax etree minidom pulldom xmlrpc ========================= ============== =============== ============== ============== ============== billion laughs **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** quadratic blowup **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** external entity expansion **Vulnerable** Safe (1) Safe (2) **Vulnerable** Safe (3) `DTD`_ retrieval **Vulnerable** Safe Safe **Vulnerable** Safe decompression bomb Safe Safe Safe Safe **Vulnerable** ========================= ============== =============== ============== ============== ============== 1. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a ParserError when an entity occurs. 2. :mod:`xml.dom.minidom` doesn't expand external entities and simply returns the unexpanded entity verbatim. 3. :mod:`xmlrpclib` doesn't expand external entities and omits them. billion laughs / exponential entity expansion The `Billion Laughs`_ attack -- also known as exponential entity expansion -- uses multiple levels of nested entities. Each entity refers to another entity several times, the final entity definition contains a small string. Eventually the small string is expanded to several gigabytes. The exponential expansion consumes lots of CPU time, too. quadratic blowup entity expansion A quadratic blowup attack is similar to a `Billion Laughs`_ attack; it abuses entity expansion, too. Instead of nested entities it repeats one large entity with a couple of thousand chars over and over again. The attack isn't as efficient as the exponential case but it avoids triggering countermeasures of parsers against heavily nested entities. external entity expansion Entity declarations can contain more than just text for replacement. They can also point to external resources by public identifiers or system identifiers. System identifiers are standard URIs or can refer to local files. The XML parser retrieves the resource with e.g. HTTP or FTP requests and embeds the content into the XML document. `DTD`_ retrieval Some XML libraries like Python's :mod:`xml.dom.pulldom` retrieve document type definitions from remote or local locations. The feature has similar implications as the external entity expansion issue. decompression bomb The issue of decompression bombs (aka `ZIP bomb`_) apply to all XML libraries that can parse compressed XML stream like gzipped HTTP streams or LZMA-ed files. For an attacker it can reduce the amount of transmitted data by three magnitudes or more. The documentation of `defusedxml`_ on PyPI has further information about all known attack vectors with examples and references. defused packages ---------------- These external packages are recommended for any code that parses untrusted XML data. `defusedxml`_ is a pure Python package with modified subclasses of all stdlib XML parsers that prevent any potentially malicious operation. The package also ships with example exploits and extended documentation on more XML exploits like xpath injection. `defusedexpat`_ provides a modified libexpat and patched replacement :mod:`pyexpat` extension module with countermeasures against entity expansion DoS attacks. Defusedexpat still allows a sane and configurable amount of entity expansions. The modifications will be merged into future releases of Python. The workarounds and modifications are not included in patch releases as they break backward compatibility. After all inline DTD and entity expansion are well-defined XML features. .. _defusedxml: https://pypi.org/project/defusedxml/ .. _defusedexpat: https://pypi.org/project/defusedexpat/ .. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs .. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb .. _DTD: https://en.wikipedia.org/wiki/Document_type_definition
Close