Move to lxml #286
Move to lxml #286
Conversation
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
|
|
||
| import junitparser | ||
| from junitparser import Element, JUnitXml, TestCase, TestSuite, Skipped | ||
| from junitparser.junitparser import etree | ||
|
|
||
| from publish.unittestresults import ParsedUnitTestResults, UnitTestCase, ParseError | ||
|
|
||
| try: | ||
| import lxml |
There was a problem hiding this comment.
blacklist: Using lxml to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml with the equivalent defusedxml package.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
There was a problem hiding this comment.
defusedxml.lxml is deprecated
There was a problem hiding this comment.
I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.
|
|
||
| import junitparser | ||
| from junitparser import Element, JUnitXml, TestCase, TestSuite, Skipped | ||
| from junitparser.junitparser import etree | ||
|
|
||
| from publish.unittestresults import ParsedUnitTestResults, UnitTestCase, ParseError | ||
|
|
||
| try: | ||
| import lxml |
There was a problem hiding this comment.
opt.semgrep.python.lang.security.use-defused-xml.use-defused-xml: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead if the XML being
loaded is untrusted.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
There was a problem hiding this comment.
defusedxml.lxml is deprecated
There was a problem hiding this comment.
I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.
This comment has been minimized.
This comment has been minimized.
Test Results (Test Files) 26 files ±0 4 errors 23 suites ±0 39m 21s ⏱️ ±0s For more details on these parsing errors, failures and errors, see this check. Results for commit 95718c8. ± Comparison against base commit c8ce9bb. ♻️ This comment has been updated with latest results. |
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-move-to-lxml
branch
from
2ef3da3 to
a6568f7
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-move-to-lxml
branch
from
a6568f7 to
ecc3cca
Compare
This comment has been minimized.
This comment has been minimized.
No description provided.