github/acrn-hypervisor
1
0
Fork 0
mirror of https://github.com/projectacrn/acrn-hypervisor.git synced 2025-09-22 01:07:57 +00:00
Code Issues Projects Releases Wiki Activity

misc: Bandit scan issue for lxml

Browse Source 
This patch is to fix Bandit scan issue b313-b320 which is vulnerable to
XML attacks when parsing untrusted XML data.

I replace lxml.etree with the equivalent defusedxml package.

I confirm it works after making a Bandit scan, building the configurator
and compiling the acrn.

Signed-off-by: dongpingx <dongpingx.wu@intel.com>
Tracked-On: #8717
This commit is contained in:
dongpingx
2024-08-28 16:42:02 +08:00
committed by acrnsi-robot
parent 8c8dfdca9a
commit 6f96614e6f
16 changed files with 53 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
misc/config_tools/acpi_gen/asl_gen.py
View File

@@ -9,7 +9,7 @@ import sys, os, re, argparse, shutil, ctypes
from acpi_const import *
import board_cfg_lib, acrn_config_utilities
import collections
import lxml.etree
from defusedxml.lxml import parse
from acrn_config_utilities import get_node
sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'board_inspector'))
@@ -861,11 +861,11 @@ def main(args):
scenario= params['--scenario']
out = params['--out']
board_etree = lxml.etree.parse(board)
board_etree = parse(board)
board_root = board_etree.getroot()
scenario_etree = lxml.etree.parse(scenario)
scenario_etree = parse(scenario)
scenario_root = scenario_etree.getroot()
allocation_etree = lxml.etree.parse(os.path.join(os.path.dirname(board), "configs", "allocation.xml"))
allocation_etree = parse(os.path.join(os.path.dirname(board), "configs", "allocation.xml"))
board_type = board_root.attrib['board']
scenario_name = scenario_root.attrib['scenario']
pcpu_list = board_root.find('CPU_PROCESSOR_INFO').text.strip().split(',')