diff --git a/introduction/views.py b/introduction/views.py index b4ed8cf78..273045428 100644 --- a/introduction/views.py +++ b/introduction/views.py @@ -17,9 +17,8 @@ from .models import FAANG,info,login,comments,otp from random import randint -from xml.dom.pulldom import parseString, START_ELEMENT +from xml.dom.pulldom import START_ELEMENT from xml.sax.handler import feature_external_ges -from xml.sax import make_parser from django.views.decorators.csrf import csrf_exempt from django.template import loader from django.template.loader import render_to_string @@ -39,6 +38,9 @@ import logging import requests import re +import defusedxml.pulldom +import defusedxml.sax + #*****************************************Login and Registration****************************************************# def register(request): @@ -247,9 +249,9 @@ def xxe_see(request): @csrf_exempt def xxe_parse(request): - parser = make_parser() + parser = defusedxml.sax.make_parser() parser.setFeature(feature_external_ges, True) - doc = parseString(request.body.decode('utf-8'), parser=parser) + doc = defusedxml.pulldom.parseString(request.body.decode('utf-8'), parser=parser) for event, node in doc: if event == START_ELEMENT and node.tagName == 'text': doc.expandNode(node)