From e80f7d347ecdc3afaae8e3e8adacdf1c0afbed23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sylvain=20Mari=C3=A9?= Date: Tue, 18 May 2021 09:51:11 +0200 Subject: [PATCH 1/2] Fix security vulnerability by using safe xml parser if available Fixes #14 --- xunitparser.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/xunitparser.py b/xunitparser.py index d72fe2b..5b81a7a 100644 --- a/xunitparser.py +++ b/xunitparser.py @@ -1,7 +1,11 @@ import math import unittest from datetime import timedelta -from xml.etree import ElementTree + +try: + from defusedxml import ElementTree +except ImportError: + from xml.etree import ElementTree def to_timedelta(val): From eb113dcd2355bf9a7cfd4d9165dab399d28ffed9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sylvain=20Mari=C3=A9?= Date: Tue, 18 May 2021 09:52:30 +0200 Subject: [PATCH 2/2] Update xunitparser.py --- xunitparser.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/xunitparser.py b/xunitparser.py index 5b81a7a..ba9efd3 100644 --- a/xunitparser.py +++ b/xunitparser.py @@ -3,6 +3,8 @@ from datetime import timedelta try: + # Use the safe XML parser (defusedxml) when available + # See https://docs.python.org/3/library/xml.etree.elementtree.html from defusedxml import ElementTree except ImportError: from xml.etree import ElementTree