Linux cpanel.rrshost.in 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64
Apache
: 109.123.238.221 | : 172.69.17.164
128 Domain
8.2.28
aev999
Terminal
AUTO ROOT
Adminer
Backdoor Destroyer
Linux Exploit
Lock Shell
Lock File
Create User
CREATE RDP
PHP Mailer
BACKCONNECT
HASH IDENTIFIER
README
+ Create Folder
+ Create File
/
usr /
share /
doc /
python2.7 /
html /
library /
[ HOME SHELL ]
Name
Size
Permission
Action
2to3.html
63.71
KB
-rw-r--r--
__builtin__.html
11.79
KB
-rw-r--r--
__future__.html
15.58
KB
-rw-r--r--
__main__.html
8.33
KB
-rw-r--r--
_winreg.html
73.99
KB
-rw-r--r--
abc.html
26.82
KB
-rw-r--r--
aepack.html
15.47
KB
-rw-r--r--
aetools.html
18.79
KB
-rw-r--r--
aetypes.html
27.08
KB
-rw-r--r--
aifc.html
29.59
KB
-rw-r--r--
al.html
22.13
KB
-rw-r--r--
allos.html
35.48
KB
-rw-r--r--
anydbm.html
19.31
KB
-rw-r--r--
archiving.html
10.64
KB
-rw-r--r--
argparse.html
269.59
KB
-rw-r--r--
array.html
35.35
KB
-rw-r--r--
ast.html
42.42
KB
-rw-r--r--
asynchat.html
35.84
KB
-rw-r--r--
asyncore.html
43.22
KB
-rw-r--r--
atexit.html
19.23
KB
-rw-r--r--
audioop.html
41.32
KB
-rw-r--r--
autogil.html
9.77
KB
-rw-r--r--
base64.html
24.8
KB
-rw-r--r--
basehttpserver.html
40.6
KB
-rw-r--r--
bastion.html
13.02
KB
-rw-r--r--
bdb.html
50.06
KB
-rw-r--r--
binascii.html
26.64
KB
-rw-r--r--
binhex.html
12.66
KB
-rw-r--r--
bisect.html
28.52
KB
-rw-r--r--
bsddb.html
32.02
KB
-rw-r--r--
bz2.html
31.92
KB
-rw-r--r--
calendar.html
50.16
KB
-rw-r--r--
carbon.html
54.14
KB
-rw-r--r--
cd.html
35.24
KB
-rw-r--r--
cgi.html
58.4
KB
-rw-r--r--
cgihttpserver.html
15.12
KB
-rw-r--r--
cgitb.html
13.5
KB
-rw-r--r--
chunk.html
17.41
KB
-rw-r--r--
cmath.html
32.41
KB
-rw-r--r--
cmd.html
32.69
KB
-rw-r--r--
code.html
28.92
KB
-rw-r--r--
codecs.html
125.92
KB
-rw-r--r--
codeop.html
16.42
KB
-rw-r--r--
collections.html
150.36
KB
-rw-r--r--
colorpicker.html
9.02
KB
-rw-r--r--
colorsys.html
14.38
KB
-rw-r--r--
commands.html
16.63
KB
-rw-r--r--
compileall.html
21.18
KB
-rw-r--r--
compiler.html
78.14
KB
-rw-r--r--
configparser.html
73.92
KB
-rw-r--r--
constants.html
14.68
KB
-rw-r--r--
contextlib.html
22.91
KB
-rw-r--r--
cookie.html
45.38
KB
-rw-r--r--
cookielib.html
102.78
KB
-rw-r--r--
copy.html
14.21
KB
-rw-r--r--
copy_reg.html
15.82
KB
-rw-r--r--
crypt.html
11.62
KB
-rw-r--r--
crypto.html
8.35
KB
-rw-r--r--
csv.html
82.79
KB
-rw-r--r--
ctypes.html
280.57
KB
-rw-r--r--
curses.ascii.html
28.97
KB
-rw-r--r--
curses.html
200.94
KB
-rw-r--r--
curses.panel.html
18.43
KB
-rw-r--r--
custominterp.html
8.59
KB
-rw-r--r--
datatypes.html
18.84
KB
-rw-r--r--
datetime.html
261.02
KB
-rw-r--r--
dbhash.html
18.4
KB
-rw-r--r--
dbm.html
14.75
KB
-rw-r--r--
debug.html
11.28
KB
-rw-r--r--
decimal.html
239.14
KB
-rw-r--r--
development.html
15.27
KB
-rw-r--r--
difflib.html
96.93
KB
-rw-r--r--
dircache.html
13.66
KB
-rw-r--r--
dis.html
96.52
KB
-rw-r--r--
distribution.html
8.27
KB
-rw-r--r--
distutils.html
10.97
KB
-rw-r--r--
dl.html
19.27
KB
-rw-r--r--
doctest.html
193.18
KB
-rw-r--r--
docxmlrpcserver.html
20.02
KB
-rw-r--r--
dumbdbm.html
16.74
KB
-rw-r--r--
dummy_thread.html
11.04
KB
-rw-r--r--
dummy_threading.html
9.96
KB
-rw-r--r--
easydialogs.html
38.83
KB
-rw-r--r--
email-examples.html
47.2
KB
-rw-r--r--
email.charset.html
32.45
KB
-rw-r--r--
email.encoders.html
14.09
KB
-rw-r--r--
email.errors.html
19.2
KB
-rw-r--r--
email.generator.html
24.78
KB
-rw-r--r--
email.header.html
31.12
KB
-rw-r--r--
email.html
55.3
KB
-rw-r--r--
email.iterators.html
14.22
KB
-rw-r--r--
email.message.html
74.91
KB
-rw-r--r--
email.mime.html
34.51
KB
-rw-r--r--
email.parser.html
37.09
KB
-rw-r--r--
email.utils.html
30.04
KB
-rw-r--r--
ensurepip.html
20.21
KB
-rw-r--r--
errno.html
52.31
KB
-rw-r--r--
exceptions.html
73.4
KB
-rw-r--r--
fcntl.html
27.85
KB
-rw-r--r--
filecmp.html
26.49
KB
-rw-r--r--
fileformats.html
10.21
KB
-rw-r--r--
fileinput.html
29.36
KB
-rw-r--r--
filesys.html
11.55
KB
-rw-r--r--
fl.html
71.58
KB
-rw-r--r--
fm.html
15
KB
-rw-r--r--
fnmatch.html
17.78
KB
-rw-r--r--
formatter.html
43.91
KB
-rw-r--r--
fpectl.html
17.84
KB
-rw-r--r--
fpformat.html
12.65
KB
-rw-r--r--
fractions.html
27.17
KB
-rw-r--r--
framework.html
44.24
KB
-rw-r--r--
frameworks.html
8.11
KB
-rw-r--r--
ftplib.html
56.56
KB
-rw-r--r--
functions.html
216.84
KB
-rw-r--r--
functools.html
31.06
KB
-rw-r--r--
future_builtins.html
15.9
KB
-rw-r--r--
gc.html
30.74
KB
-rw-r--r--
gdbm.html
19.35
KB
-rw-r--r--
gensuitemodule.html
14.54
KB
-rw-r--r--
getopt.html
26.56
KB
-rw-r--r--
getpass.html
12.5
KB
-rw-r--r--
gettext.html
91.32
KB
-rw-r--r--
gl.html
26.71
KB
-rw-r--r--
glob.html
15.42
KB
-rw-r--r--
grp.html
12.33
KB
-rw-r--r--
gzip.html
21.95
KB
-rw-r--r--
hashlib.html
27.4
KB
-rw-r--r--
heapq.html
36.72
KB
-rw-r--r--
hmac.html
15.97
KB
-rw-r--r--
hotshot.html
22.69
KB
-rw-r--r--
htmllib.html
29.9
KB
-rw-r--r--
htmlparser.html
45.11
KB
-rw-r--r--
httplib.html
78.55
KB
-rw-r--r--
i18n.html
10.61
KB
-rw-r--r--
ic.html
22.03
KB
-rw-r--r--
idle.html
45.74
KB
-rw-r--r--
imageop.html
20.94
KB
-rw-r--r--
imaplib.html
69.9
KB
-rw-r--r--
imgfile.html
14.91
KB
-rw-r--r--
imghdr.html
13.43
KB
-rw-r--r--
imp.html
41.48
KB
-rw-r--r--
importlib.html
10.27
KB
-rw-r--r--
imputil.html
36.11
KB
-rw-r--r--
index.html
82.54
KB
-rw-r--r--
inspect.html
64.31
KB
-rw-r--r--
internet.html
26.77
KB
-rw-r--r--
intro.html
9.76
KB
-rw-r--r--
io.html
122.3
KB
-rw-r--r--
ipc.html
17.18
KB
-rw-r--r--
itertools.html
129.91
KB
-rw-r--r--
jpeg.html
15.36
KB
-rw-r--r--
json.html
79.09
KB
-rw-r--r--
keyword.html
9.27
KB
-rw-r--r--
language.html
12.35
KB
-rw-r--r--
linecache.html
12.7
KB
-rw-r--r--
locale.html
68.54
KB
-rw-r--r--
logging.config.html
82.23
KB
-rw-r--r--
logging.handlers.html
91.96
KB
-rw-r--r--
logging.html
123.15
KB
-rw-r--r--
mac.html
24.49
KB
-rw-r--r--
macos.html
18.51
KB
-rw-r--r--
macosa.html
14.55
KB
-rw-r--r--
macostools.html
19.67
KB
-rw-r--r--
macpath.html
9.19
KB
-rw-r--r--
mailbox.html
185.53
KB
-rw-r--r--
mailcap.html
15.3
KB
-rw-r--r--
markup.html
20.37
KB
-rw-r--r--
marshal.html
19.88
KB
-rw-r--r--
math.html
50.52
KB
-rw-r--r--
md5.html
16.65
KB
-rw-r--r--
mhlib.html
30.04
KB
-rw-r--r--
mimetools.html
23.84
KB
-rw-r--r--
mimetypes.html
35.82
KB
-rw-r--r--
mimewriter.html
18.19
KB
-rw-r--r--
mimify.html
16.96
KB
-rw-r--r--
miniaeframe.html
14.5
KB
-rw-r--r--
misc.html
7.77
KB
-rw-r--r--
mm.html
10.19
KB
-rw-r--r--
mmap.html
33.52
KB
-rw-r--r--
modulefinder.html
19.85
KB
-rw-r--r--
modules.html
9.68
KB
-rw-r--r--
msilib.html
72.78
KB
-rw-r--r--
msvcrt.html
24.1
KB
-rw-r--r--
multifile.html
28.82
KB
-rw-r--r--
multiprocessing.html
423.97
KB
-rw-r--r--
mutex.html
13.56
KB
-rw-r--r--
netdata.html
19.28
KB
-rw-r--r--
netrc.html
15.51
KB
-rw-r--r--
new.html
16.1
KB
-rw-r--r--
nis.html
13.19
KB
-rw-r--r--
nntplib.html
51.08
KB
-rw-r--r--
numbers.html
40.91
KB
-rw-r--r--
numeric.html
14.85
KB
-rw-r--r--
operator.html
118.32
KB
-rw-r--r--
optparse.html
251.08
KB
-rw-r--r--
os.html
270.49
KB
-rw-r--r--
os.path.html
48.87
KB
-rw-r--r--
ossaudiodev.html
49.79
KB
-rw-r--r--
othergui.html
9.98
KB
-rw-r--r--
parser.html
44.52
KB
-rw-r--r--
pdb.html
41.44
KB
-rw-r--r--
persistence.html
16.25
KB
-rw-r--r--
pickle.html
107.94
KB
-rw-r--r--
pickletools.html
13.21
KB
-rw-r--r--
pipes.html
21.85
KB
-rw-r--r--
pkgutil.html
30.59
KB
-rw-r--r--
platform.html
40.14
KB
-rw-r--r--
plistlib.html
20.96
KB
-rw-r--r--
popen2.html
30.13
KB
-rw-r--r--
poplib.html
27.93
KB
-rw-r--r--
posix.html
17.27
KB
-rw-r--r--
posixfile.html
23.68
KB
-rw-r--r--
pprint.html
36.42
KB
-rw-r--r--
profile.html
76.65
KB
-rw-r--r--
pty.html
11.42
KB
-rw-r--r--
pwd.html
13.53
KB
-rw-r--r--
py_compile.html
13.33
KB
-rw-r--r--
pyclbr.html
18.14
KB
-rw-r--r--
pydoc.html
14.33
KB
-rw-r--r--
pyexpat.html
93.28
KB
-rw-r--r--
python.html
13.53
KB
-rw-r--r--
queue.html
29.64
KB
-rw-r--r--
quopri.html
14.5
KB
-rw-r--r--
random.html
47.78
KB
-rw-r--r--
re.html
163.11
KB
-rw-r--r--
readline.html
41.2
KB
-rw-r--r--
repr.html
24.57
KB
-rw-r--r--
resource.html
30.86
KB
-rw-r--r--
restricted.html
12.69
KB
-rw-r--r--
rexec.html
43.59
KB
-rw-r--r--
rfc822.html
51.25
KB
-rw-r--r--
rlcompleter.html
15.29
KB
-rw-r--r--
robotparser.html
15.01
KB
-rw-r--r--
runpy.html
23.55
KB
-rw-r--r--
sched.html
21.76
KB
-rw-r--r--
scrolledtext.html
10.67
KB
-rw-r--r--
select.html
50.17
KB
-rw-r--r--
sets.html
39.92
KB
-rw-r--r--
sgi.html
11.09
KB
-rw-r--r--
sgmllib.html
38.77
KB
-rw-r--r--
sha.html
14.55
KB
-rw-r--r--
shelve.html
32.93
KB
-rw-r--r--
shlex.html
38.43
KB
-rw-r--r--
shutil.html
49.49
KB
-rw-r--r--
signal.html
36.52
KB
-rw-r--r--
simplehttpserver.html
21.57
KB
-rw-r--r--
simplexmlrpcserver.html
40.41
KB
-rw-r--r--
site.html
29
KB
-rw-r--r--
smtpd.html
15.64
KB
-rw-r--r--
smtplib.html
51.86
KB
-rw-r--r--
sndhdr.html
12.05
KB
-rw-r--r--
socket.html
126.94
KB
-rw-r--r--
socketserver.html
81.38
KB
-rw-r--r--
someos.html
17.09
KB
-rw-r--r--
spwd.html
12.25
KB
-rw-r--r--
sqlite3.html
154.12
KB
-rw-r--r--
ssl.html
214.5
KB
-rw-r--r--
stat.html
41.11
KB
-rw-r--r--
statvfs.html
13.24
KB
-rw-r--r--
stdtypes.html
309.83
KB
-rw-r--r--
string.html
129.58
KB
-rw-r--r--
stringio.html
21.1
KB
-rw-r--r--
stringprep.html
21.4
KB
-rw-r--r--
strings.html
16.42
KB
-rw-r--r--
struct.html
47.68
KB
-rw-r--r--
subprocess.html
117
KB
-rw-r--r--
sun.html
7.83
KB
-rw-r--r--
sunau.html
35.43
KB
-rw-r--r--
sunaudio.html
21.05
KB
-rw-r--r--
symbol.html
9.06
KB
-rw-r--r--
symtable.html
29.03
KB
-rw-r--r--
sys.html
118.12
KB
-rw-r--r--
sysconfig.html
28.8
KB
-rw-r--r--
syslog.html
21.29
KB
-rw-r--r--
tabnanny.html
12.78
KB
-rw-r--r--
tarfile.html
99.54
KB
-rw-r--r--
telnetlib.html
30.46
KB
-rw-r--r--
tempfile.html
35.02
KB
-rw-r--r--
termios.html
19.22
KB
-rw-r--r--
test.html
61.42
KB
-rw-r--r--
textwrap.html
32.28
KB
-rw-r--r--
thread.html
22.67
KB
-rw-r--r--
threading.html
92.04
KB
-rw-r--r--
time.html
65.55
KB
-rw-r--r--
timeit.html
44.38
KB
-rw-r--r--
tix.html
56.73
KB
-rw-r--r--
tk.html
26.76
KB
-rw-r--r--
tkinter.html
86.67
KB
-rw-r--r--
token.html
27.31
KB
-rw-r--r--
tokenize.html
21.69
KB
-rw-r--r--
trace.html
33.91
KB
-rw-r--r--
traceback.html
44.22
KB
-rw-r--r--
ttk.html
123.83
KB
-rw-r--r--
tty.html
10.95
KB
-rw-r--r--
turtle.html
246.17
KB
-rw-r--r--
types.html
33.66
KB
-rw-r--r--
undoc.html
25.54
KB
-rw-r--r--
unicodedata.html
22.64
KB
-rw-r--r--
unittest.html
246.75
KB
-rw-r--r--
unix.html
11.9
KB
-rw-r--r--
urllib.html
71.61
KB
-rw-r--r--
urllib2.html
128.77
KB
-rw-r--r--
urlparse.html
49.04
KB
-rw-r--r--
user.html
13.41
KB
-rw-r--r--
userdict.html
32.96
KB
-rw-r--r--
uu.html
13.25
KB
-rw-r--r--
uuid.html
33.55
KB
-rw-r--r--
warnings.html
51.86
KB
-rw-r--r--
wave.html
29.08
KB
-rw-r--r--
weakref.html
41.14
KB
-rw-r--r--
webbrowser.html
29.53
KB
-rw-r--r--
whichdb.html
10.44
KB
-rw-r--r--
windows.html
10.37
KB
-rw-r--r--
winsound.html
22.56
KB
-rw-r--r--
wsgiref.html
94.38
KB
-rw-r--r--
xdrlib.html
38.05
KB
-rw-r--r--
xml.dom.html
110.39
KB
-rw-r--r--
xml.dom.minidom.html
45.23
KB
-rw-r--r--
xml.dom.pulldom.html
16.32
KB
-rw-r--r--
xml.etree.elementtree.html
124.2
KB
-rw-r--r--
xml.html
18.76
KB
-rw-r--r--
xml.sax.handler.html
47.5
KB
-rw-r--r--
xml.sax.html
26.04
KB
-rw-r--r--
xml.sax.reader.html
51.4
KB
-rw-r--r--
xml.sax.utils.html
18.11
KB
-rw-r--r--
xmlrpclib.html
71.79
KB
-rw-r--r--
zipfile.html
67.26
KB
-rw-r--r--
zipimport.html
24.32
KB
-rw-r--r--
zlib.html
34.41
KB
-rw-r--r--
Delete
Unzip
Zip
${this.title}
Close
Code Editor : xml.html
<!DOCTYPE html> <html> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" /> <title>19.5. XML Processing Modules — Python 2.7.18 documentation</title> <link rel="stylesheet" type="text/css" href="../_static/pygments.css" /> <link rel="stylesheet" type="text/css" href="../_static/classic.css" /> <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script> <script src="../_static/jquery.js"></script> <script src="../_static/underscore.js"></script> <script src="../_static/doctools.js"></script> <script src="../_static/sidebar.js"></script> <link rel="search" type="application/opensearchdescription+xml" title="Search within Python 2.7.18 documentation" href="../_static/opensearch.xml"/> <link rel="author" title="About these documents" href="../about.html" /> <link rel="index" title="Index" href="../genindex.html" /> <link rel="search" title="Search" href="../search.html" /> <link rel="copyright" title="Copyright" href="../copyright.html" /> <link rel="next" title="19.7. xml.etree.ElementTree — The ElementTree XML API" href="xml.etree.elementtree.html" /> <link rel="prev" title="19.3. htmllib — A parser for HTML documents" href="htmllib.html" /> <link rel="shortcut icon" type="image/png" href="../_static/py.png" /> <link rel="canonical" href="file:///usr/share/doc/python2.7/html/library/xml.html" /> <script type="text/javascript" src="../_static/copybutton.js"></script> </head><body> <div id="outdated-warning" style="padding: .5em; text-align: center; background-color: #FFBABA; color: #6A0E0E;"> This document is for an old version of Python that is <a href="https://devguide.python.org/devcycle/#end-of-life-branches">no longer supported</a>. You should install the python3 and python3-doc packages and read the <a href="file:///usr/share/doc/python3-doc/html/library/xml.html"> Python documentation for the Python3 version packaged in this release</a>. </div> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" accesskey="I">index</a></li> <li class="right" > <a href="../py-modindex.html" title="Python Module Index" >modules</a> |</li> <li class="right" > <a href="xml.etree.elementtree.html" title="19.7. xml.etree.ElementTree — The ElementTree XML API" accesskey="N">next</a> |</li> <li class="right" > <a href="htmllib.html" title="19.3. htmllib — A parser for HTML documents" accesskey="P">previous</a> |</li> <li><img src="../_static/py.png" alt="" style="vertical-align: middle; margin-top: -1px"/></li> <li><a href="https://www.python.org/">Python</a> »</li> <li> <a href="../index.html">Python 2.7.18 documentation</a> » </li> <li class="nav-item nav-item-1"><a href="index.html" >The Python Standard Library</a> »</li> <li class="nav-item nav-item-2"><a href="markup.html" accesskey="U"><span class="section-number">19. </span>Structured Markup Processing Tools</a> »</li> <li class="nav-item nav-item-this"><a href=""><span class="section-number">19.5. </span>XML Processing Modules</a></li> </ul> </div> <div class="document"> <div class="documentwrapper"> <div class="bodywrapper"> <div class="body" role="main"> <section id="module-xml"> <span id="xml-processing-modules"></span><span id="xml"></span><h1><span class="section-number">19.5. </span>XML Processing Modules<a class="headerlink" href="#module-xml" title="Permalink to this headline">¶</a></h1> <p>Python’s interfaces for processing XML are grouped in the <code class="docutils literal notranslate"><span class="pre">xml</span></code> package.</p> <div class="admonition warning"> <p class="admonition-title">Warning</p> <p>The XML modules are not secure against erroneous or maliciously constructed data. If you need to parse untrusted or unauthenticated data see <a class="reference internal" href="#xml-vulnerabilities"><span class="std std-ref">XML vulnerabilities</span></a>.</p> </div> <p>It is important to note that modules in the <a class="reference internal" href="#module-xml" title="xml: Package containing XML processing modules"><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml</span></code></a> package require that there be at least one SAX-compliant XML parser available. The Expat parser is included with Python, so the <a class="reference internal" href="pyexpat.html#module-xml.parsers.expat" title="xml.parsers.expat: An interface to the Expat non-validating XML parser."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.parsers.expat</span></code></a> module will always be available.</p> <p>The documentation for the <a class="reference internal" href="xml.dom.html#module-xml.dom" title="xml.dom: Document Object Model API for Python."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom</span></code></a> and <a class="reference internal" href="xml.sax.html#module-xml.sax" title="xml.sax: Package containing SAX2 base classes and convenience functions."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.sax</span></code></a> packages are the definition of the Python bindings for the DOM and SAX interfaces.</p> <p>The XML handling submodules are:</p> <ul class="simple"> <li><p><a class="reference internal" href="xml.etree.elementtree.html#module-xml.etree.ElementTree" title="xml.etree.ElementTree: Implementation of the ElementTree API."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.etree.ElementTree</span></code></a>: the ElementTree API, a simple and lightweight XML processor</p></li> </ul> <ul class="simple"> <li><p><a class="reference internal" href="xml.dom.html#module-xml.dom" title="xml.dom: Document Object Model API for Python."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom</span></code></a>: the DOM API definition</p></li> <li><p><a class="reference internal" href="xml.dom.minidom.html#module-xml.dom.minidom" title="xml.dom.minidom: Minimal Document Object Model (DOM) implementation."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom.minidom</span></code></a>: a minimal DOM implementation</p></li> <li><p><a class="reference internal" href="xml.dom.pulldom.html#module-xml.dom.pulldom" title="xml.dom.pulldom: Support for building partial DOM trees from SAX events."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom.pulldom</span></code></a>: support for building partial DOM trees</p></li> </ul> <ul class="simple"> <li><p><a class="reference internal" href="xml.sax.html#module-xml.sax" title="xml.sax: Package containing SAX2 base classes and convenience functions."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.sax</span></code></a>: SAX2 base classes and convenience functions</p></li> <li><p><a class="reference internal" href="pyexpat.html#module-xml.parsers.expat" title="xml.parsers.expat: An interface to the Expat non-validating XML parser."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.parsers.expat</span></code></a>: the Expat parser binding</p></li> </ul> </section> <section id="xml-vulnerabilities"> <span id="id1"></span><h1><span class="section-number">19.6. </span>XML vulnerabilities<a class="headerlink" href="#xml-vulnerabilities" title="Permalink to this headline">¶</a></h1> <p>The XML processing modules are not secure against maliciously constructed data. An attacker can abuse vulnerabilities for e.g. denial of service attacks, to access local files, to generate network connections to other machines, or to or circumvent firewalls. The attacks on XML abuse unfamiliar features like inline <a class="reference external" href="https://en.wikipedia.org/wiki/Document_type_definition">DTD</a> (document type definition) with entities.</p> <p>The following table gives an overview of the known attacks and if the various modules are vulnerable to them.</p> <table class="docutils align-default"> <colgroup> <col style="width: 26%" /> <col style="width: 15%" /> <col style="width: 16%" /> <col style="width: 15%" /> <col style="width: 15%" /> <col style="width: 15%" /> </colgroup> <thead> <tr class="row-odd"><th class="head"><p>kind</p></th> <th class="head"><p>sax</p></th> <th class="head"><p>etree</p></th> <th class="head"><p>minidom</p></th> <th class="head"><p>pulldom</p></th> <th class="head"><p>xmlrpc</p></th> </tr> </thead> <tbody> <tr class="row-even"><td><p>billion laughs</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> </tr> <tr class="row-odd"><td><p>quadratic blowup</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p><strong>Vulnerable</strong></p></td> </tr> <tr class="row-even"><td><p>external entity expansion</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p>Safe (1)</p></td> <td><p>Safe (2)</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p>Safe (3)</p></td> </tr> <tr class="row-odd"><td><p><a class="reference external" href="https://en.wikipedia.org/wiki/Document_type_definition">DTD</a> retrieval</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p>Safe</p></td> <td><p>Safe</p></td> <td><p><strong>Vulnerable</strong></p></td> <td><p>Safe</p></td> </tr> <tr class="row-even"><td><p>decompression bomb</p></td> <td><p>Safe</p></td> <td><p>Safe</p></td> <td><p>Safe</p></td> <td><p>Safe</p></td> <td><p><strong>Vulnerable</strong></p></td> </tr> </tbody> </table> <ol class="arabic simple"> <li><p><a class="reference internal" href="xml.etree.elementtree.html#module-xml.etree.ElementTree" title="xml.etree.ElementTree: Implementation of the ElementTree API."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.etree.ElementTree</span></code></a> doesn’t expand external entities and raises a ParserError when an entity occurs.</p></li> <li><p><a class="reference internal" href="xml.dom.minidom.html#module-xml.dom.minidom" title="xml.dom.minidom: Minimal Document Object Model (DOM) implementation."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom.minidom</span></code></a> doesn’t expand external entities and simply returns the unexpanded entity verbatim.</p></li> <li><p><a class="reference internal" href="xmlrpclib.html#module-xmlrpclib" title="xmlrpclib: XML-RPC client access."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xmlrpclib</span></code></a> doesn’t expand external entities and omits them.</p></li> </ol> <dl class="simple"> <dt>billion laughs / exponential entity expansion</dt><dd><p>The <a class="reference external" href="https://en.wikipedia.org/wiki/Billion_laughs">Billion Laughs</a> attack – also known as exponential entity expansion – uses multiple levels of nested entities. Each entity refers to another entity several times, the final entity definition contains a small string. Eventually the small string is expanded to several gigabytes. The exponential expansion consumes lots of CPU time, too.</p> </dd> <dt>quadratic blowup entity expansion</dt><dd><p>A quadratic blowup attack is similar to a <a class="reference external" href="https://en.wikipedia.org/wiki/Billion_laughs">Billion Laughs</a> attack; it abuses entity expansion, too. Instead of nested entities it repeats one large entity with a couple of thousand chars over and over again. The attack isn’t as efficient as the exponential case but it avoids triggering countermeasures of parsers against heavily nested entities.</p> </dd> <dt>external entity expansion</dt><dd><p>Entity declarations can contain more than just text for replacement. They can also point to external resources by public identifiers or system identifiers. System identifiers are standard URIs or can refer to local files. The XML parser retrieves the resource with e.g. HTTP or FTP requests and embeds the content into the XML document.</p> </dd> <dt><a class="reference external" href="https://en.wikipedia.org/wiki/Document_type_definition">DTD</a> retrieval</dt><dd><p>Some XML libraries like Python’s <a class="reference internal" href="xml.dom.pulldom.html#module-xml.dom.pulldom" title="xml.dom.pulldom: Support for building partial DOM trees from SAX events."><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.dom.pulldom</span></code></a> retrieve document type definitions from remote or local locations. The feature has similar implications as the external entity expansion issue.</p> </dd> <dt>decompression bomb</dt><dd><p>The issue of decompression bombs (aka <a class="reference external" href="https://en.wikipedia.org/wiki/Zip_bomb">ZIP bomb</a>) apply to all XML libraries that can parse compressed XML stream like gzipped HTTP streams or LZMA-ed files. For an attacker it can reduce the amount of transmitted data by three magnitudes or more.</p> </dd> </dl> <p>The documentation of <a class="reference external" href="https://pypi.org/project/defusedxml/">defusedxml</a> on PyPI has further information about all known attack vectors with examples and references.</p> <section id="defused-packages"> <h2><span class="section-number">19.6.1. </span>defused packages<a class="headerlink" href="#defused-packages" title="Permalink to this headline">¶</a></h2> <p>These external packages are recommended for any code that parses untrusted XML data.</p> <p><a class="reference external" href="https://pypi.org/project/defusedxml/">defusedxml</a> is a pure Python package with modified subclasses of all stdlib XML parsers that prevent any potentially malicious operation. The package also ships with example exploits and extended documentation on more XML exploits like xpath injection.</p> <p><a class="reference external" href="https://pypi.org/project/defusedexpat/">defusedexpat</a> provides a modified libexpat and patched replacement <code class="xref py py-mod docutils literal notranslate"><span class="pre">pyexpat</span></code> extension module with countermeasures against entity expansion DoS attacks. Defusedexpat still allows a sane and configurable amount of entity expansions. The modifications will be merged into future releases of Python.</p> <p>The workarounds and modifications are not included in patch releases as they break backward compatibility. After all inline DTD and entity expansion are well-defined XML features.</p> </section> </section> <div class="clearer"></div> </div> </div> </div> <div class="sphinxsidebar" role="navigation" aria-label="main navigation"> <div class="sphinxsidebarwrapper"> <h3><a href="../contents.html">Table of Contents</a></h3> <ul> <li><a class="reference internal" href="#">19.5. XML Processing Modules</a></li> <li><a class="reference internal" href="#xml-vulnerabilities">19.6. XML vulnerabilities</a><ul> <li><a class="reference internal" href="#defused-packages">19.6.1. defused packages</a></li> </ul> </li> </ul> <h4>Previous topic</h4> <p class="topless"><a href="htmllib.html" title="previous chapter"><span class="section-number">19.3. </span><code class="xref py py-mod docutils literal notranslate"><span class="pre">htmllib</span></code> — A parser for HTML documents</a></p> <h4>Next topic</h4> <p class="topless"><a href="xml.etree.elementtree.html" title="next chapter"><span class="section-number">19.7. </span><code class="xref py py-mod docutils literal notranslate"><span class="pre">xml.etree.ElementTree</span></code> — The ElementTree XML API</a></p> <div role="note" aria-label="source link"> <h3>This Page</h3> <ul class="this-page-menu"> <li><a href="../_sources/library/xml.rst.txt" rel="nofollow">Show Source</a></li> </ul> </div> <div id="searchbox" style="display: none" role="search"> <h3 id="searchlabel">Quick search</h3> <div class="searchformwrapper"> <form class="search" action="../search.html" method="get"> <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/> <input type="submit" value="Go" /> </form> </div> </div> <script>$('#searchbox').show(0);</script> </div> </div> <div class="clearer"></div> </div> <div class="related" role="navigation" aria-label="related navigation"> <h3>Navigation</h3> <ul> <li class="right" style="margin-right: 10px"> <a href="../genindex.html" title="General Index" >index</a></li> <li class="right" > <a href="../py-modindex.html" title="Python Module Index" >modules</a> |</li> <li class="right" > <a href="xml.etree.elementtree.html" title="19.7. xml.etree.ElementTree — The ElementTree XML API" >next</a> |</li> <li class="right" > <a href="htmllib.html" title="19.3. htmllib — A parser for HTML documents" >previous</a> |</li> <li><img src="../_static/py.png" alt="" style="vertical-align: middle; margin-top: -1px"/></li> <li><a href="https://www.python.org/">Python</a> »</li> <li> <a href="../index.html">Python 2.7.18 documentation</a> » </li> <li class="nav-item nav-item-1"><a href="index.html" >The Python Standard Library</a> »</li> <li class="nav-item nav-item-2"><a href="markup.html" ><span class="section-number">19. </span>Structured Markup Processing Tools</a> »</li> <li class="nav-item nav-item-this"><a href=""><span class="section-number">19.5. </span>XML Processing Modules</a></li> </ul> </div> <div class="footer"> © <a href="../copyright.html">Copyright</a> 1990-2024, Python Software Foundation. <br /> The Python Software Foundation is a non-profit corporation. <a href="https://www.python.org/psf/donations/">Please donate.</a> <br /> Last updated on December 09, 2024. <a href="../bugs.html">Found a bug</a>? <br /> Created using <a href="http://sphinx.pocoo.org/">Sphinx</a> 4.3.2. </div> </body> </html>
Close