-
-
Notifications
You must be signed in to change notification settings - Fork 186
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for TRX files #287
Conversation
from typing import Iterable, Tuple, Union | ||
|
||
from junitparser import JUnitXml | ||
from lxml import etree |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help
or ignore
)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
return Exception(f'File is empty.') | ||
|
||
try: | ||
trx = etree.parse(path) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help
or ignore
)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
from typing import Iterable, Tuple, Union | ||
|
||
from junitparser import JUnitXml | ||
from lxml import etree |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
opt.semgrep.python.lang.security.use-defused-xml.use-defused-xml: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead if the XML being
loaded is untrusted.
(at-me in a reply with help
or ignore
)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
This comment has been minimized.
This comment has been minimized.
Test Results (Test Files) 35 files + 9 4 errors 32 suites +9 39m 52s ⏱️ +31s For more details on these parsing errors, failures and errors, see this check. Results for commit 7067fa3. ± Comparison against base commit b776d2f. ♻️ This comment has been updated with latest results. |
Test Results (Linux 22.04 python installed) 69 files ± 0 69 suites ±0 24m 4s ⏱️ + 7m 39s Results for commit 7067fa3. ± Comparison against base commit b776d2f. ♻️ This comment has been updated with latest results. |
Test Results (reference) 69 files ± 0 69 suites ±0 24m 4s ⏱️ + 7m 39s Results for commit 7067fa3. ± Comparison against base commit b776d2f. This pull request removes 15 and adds 7 tests. Note that renamed tests count towards both.
♻️ This comment has been updated with latest results. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
python/test/test_trx.py
Outdated
|
||
def test_transform(self): | ||
result_file = str(test_files_path / 'mstest.trx') | ||
trx = etree.parse(str(result_file)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help
or ignore
)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/test/test_trx.py
Outdated
import pathlib | ||
import unittest | ||
|
||
from lxml import etree |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help
or ignore
)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
Fixes #279.