Add support for XUnit files #288
Conversation
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
python/publish/trx.py
Outdated
| from typing import Iterable, Tuple, Union | ||
|
|
||
| from junitparser import JUnitXml | ||
| from lxml import etree |
There was a problem hiding this comment.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/publish/trx.py
Outdated
| return Exception(f'File is empty.') | ||
|
|
||
| try: | ||
| trx = etree.parse(path) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/publish/trx.py
Outdated
|
|
||
|
|
||
| with (pathlib.Path(__file__).parent / 'xslt' / 'trx-to-junit.xslt').open('r', encoding='utf-8') as r: | ||
| transform_trx_to_junit = etree.XSLT(etree.parse(r)) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/publish/trx.py
Outdated
| from typing import Iterable, Tuple, Union | ||
|
|
||
| from junitparser import JUnitXml | ||
| from lxml import etree |
There was a problem hiding this comment.
opt.semgrep.python.lang.security.use-defused-xml.use-defused-xml: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead if the XML being
loaded is untrusted.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
2 times, most recently
from
5f2eea1 to
de47ad4
Compare
|
|
||
|
|
||
| with (pathlib.Path(__file__).parent / 'xslt' / 'xunit-to-junit.xslt').open('r', encoding='utf-8') as r: | ||
| transform_xunit_to_junit = etree.XSLT(etree.parse(r)) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
| from typing import Iterable, Tuple, Union | ||
|
|
||
| from junitparser import JUnitXml | ||
| from lxml import etree |
There was a problem hiding this comment.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
| return Exception(f'File is empty.') | ||
|
|
||
| try: | ||
| trx = etree.parse(path) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
| from typing import Iterable, Tuple, Union | ||
|
|
||
| from junitparser import JUnitXml | ||
| from lxml import etree |
There was a problem hiding this comment.
opt.semgrep.python.lang.security.use-defused-xml.use-defused-xml: Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE)
attacks. The Python documentation recommends the 'defusedxml' library instead if the XML being
loaded is untrusted.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
de47ad4 to
9e00d5d
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
9e00d5d to
6a3fe69
Compare
python/test/test_trx.py
Outdated
| import pathlib | ||
| import unittest | ||
|
|
||
| from lxml import etree |
There was a problem hiding this comment.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/test/test_xunit.py
Outdated
| class TestXunit(unittest.TestCase): | ||
| def test_transform(self): | ||
| result_file = str(test_files_path / 'xunit.xml') | ||
| trx = etree.parse(str(result_file)) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/test/test_trx.py
Outdated
|
|
||
| def test_transform(self): | ||
| result_file = str(test_files_path / 'mstest.trx') | ||
| trx = etree.parse(str(result_file)) |
There was a problem hiding this comment.
blacklist: Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
python/test/test_xunit.py
Outdated
| import pathlib | ||
| import unittest | ||
|
|
||
| from lxml import etree |
There was a problem hiding this comment.
blacklist: Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.
(at-me in a reply with help or ignore)
Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
6a3fe69 to
28cc9e3
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
9bebed7 to
b1f67c1
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
devel-2.0
branch
2 times, most recently
from
36c4754 to
57463e0
Compare
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
b1f67c1 to
55940c0
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
55940c0 to
7fe05b7
Compare
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
443080c to
4433933
Compare
This comment has been minimized.
This comment has been minimized.
EnricoMi
force-pushed
the
branch-add-xunit
branch
from
4433933 to
1ae95bb
Compare
No description provided.