mirror of
https://github.com/projectacrn/acrn-hypervisor.git
synced 2025-11-19 19:04:02 +00:00
6f96614e6f
This patch is to fix Bandit scan issue b313-b320 which is vulnerable to XML attacks when parsing untrusted XML data. I replace lxml.etree with the equivalent defusedxml package. I confirm it works after making a Bandit scan, building the configurator and compiling the acrn. Signed-off-by: dongpingx <dongpingx.wu@intel.com> Tracked-On: #8717
53 lines
1.3 KiB
Python
53 lines
1.3 KiB
Python
#!/usr/bin/env python3
|
|
__package__ = 'configurator.pyodide'
|
|
|
|
from .pyodide import convert_result, nuc11_board, nuc11_scenario
|
|
|
|
import re
|
|
from lxml import etree
|
|
from defusedxml.lxml import fromstring
|
|
|
|
|
|
class GenerateSchema:
|
|
|
|
def __init__(self, board, scenario):
|
|
parser = etree.XMLParser(remove_blank_text=True)
|
|
self.board_etree = fromstring(board, parser)
|
|
self.scenario = scenario
|
|
|
|
@property
|
|
def pcis(self):
|
|
line = self.board_etree.xpath('/acrn-config/PCI_DEVICE/text()')[0]
|
|
cnt = []
|
|
for line in line.replace('\t', '').split('\n'):
|
|
re_cpi = re.compile(r'^([0-9A-Fa-f]{1,2}:[0-1][0-9A-Fa-f]\.[0-7].*)\(')
|
|
ret_ = re_cpi.search(line)
|
|
if ret_:
|
|
ret = ret_.group(1).strip()
|
|
if re.search(r'^00:00.0', ret): # omit 00:00.0
|
|
continue
|
|
cnt.append(ret)
|
|
return cnt
|
|
|
|
@property
|
|
def schemas(self):
|
|
return self.scenario
|
|
|
|
def update(self):
|
|
return sorted(list(set(self.pcis) - set(self.schemas)))
|
|
|
|
|
|
def updateSchema(board, scenario):
|
|
return convert_result(GenerateSchema(board, scenario).update())
|
|
|
|
|
|
main = updateSchema
|
|
|
|
|
|
def test():
|
|
main(nuc11_board, nuc11_scenario)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
test()
|