mirror of
https://github.com/projectacrn/acrn-hypervisor.git
synced 2025-11-19 19:04:02 +00:00
6f96614e6f
This patch is to fix Bandit scan issue b313-b320 which is vulnerable to XML attacks when parsing untrusted XML data. I replace lxml.etree with the equivalent defusedxml package. I confirm it works after making a Bandit scan, building the configurator and compiling the acrn. Signed-off-by: dongpingx <dongpingx.wu@intel.com> Tracked-On: #8717
22 lines
552 B
Python
22 lines
552 B
Python
#!/usr/bin/env python3
|
|
#
|
|
# Copyright (C) 2022 Intel Corporation.
|
|
#
|
|
# SPDX-License-Identifier: BSD-3-Clause
|
|
#
|
|
|
|
from lxml.etree import XMLParser
|
|
from defusedxml.lxml import parse
|
|
from pipeline import PipelineStage
|
|
|
|
class LXMLLoadStage(PipelineStage):
|
|
def __init__(self, tag):
|
|
self.consumes = f"{tag}_path"
|
|
self.provides = f"{tag}_etree"
|
|
|
|
def run(self, obj):
|
|
xml_path = obj.get(self.consumes)
|
|
etree = parse(xml_path, XMLParser(remove_blank_text=True))
|
|
etree.xinclude()
|
|
obj.set(self.provides, etree)
|