代码拉取完成,页面将自动刷新

Watch

1 Star 0 Fork 0

source-code-analysis/python3.7.4

代码 Issues 0 Pull Requests 0 Wiki 统计流水线

服务

加入 Gitee

与超过 1400万开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)

免费加入

已有帐号? 立即登录

文件

master

分支 (1)

管理

master

克隆/下载

HTTPS SSH SVN SVN+SSH 下载ZIP

提示

下载代码请复制以下命令到终端执行

为确保你提交的代码身份被 Gitee 正确识别,请执行以下命令完成配置

git config --global user.name userName 
git config --global user.email userEmail

初次使用 SSH 协议进行代码克隆、推送等操作时,需按下述提示完成 SSH 配置

1 生成 RSA 密钥

2 获取 RSA 公钥内容,并配置到 SSH公钥中

在 Gitee 上使用 SVN,请访问使用指南

使用 HTTPS 协议时,命令行会出现如下账号密码验证步骤。基于安全考虑,Gitee 建议配置并使用私人令牌替代登录密码进行克隆、推送等操作

Username for 'https://gitee.com': userName

Password for 'https://userName@gitee.com': # 私人令牌

分支 1

标签 0

python3.7.4

Doc

library

xml.rst

xml.rst 5.92 KB

.. _xml:

XML Processing Modules
======================

.. module:: xml
 :synopsis: Package containing XML processing modules

.. sectionauthor:: Christian Heimes <christian@python.org>
.. sectionauthor:: Georg Brandl <georg@python.org>

**Source code:** :source:`Lib/xml/`

--------------

Python's interfaces for processing XML are grouped in the ``xml`` package.

.. warning::

The XML modules are not secure against erroneous or maliciously
 constructed data. If you need to parse untrusted or
 unauthenticated data see the :ref:`xml-vulnerabilities` and
 :ref:`defused-packages` sections.

It is important to note that modules in the :mod:`xml` package require that
there be at least one SAX-compliant XML parser available. The Expat parser is
included with Python, so the :mod:`xml.parsers.expat` module will always be
available.

The documentation for the :mod:`xml.dom` and :mod:`xml.sax` packages are the
definition of the Python bindings for the DOM and SAX interfaces.

The XML handling submodules are:

* :mod:`xml.etree.ElementTree`: the ElementTree API, a simple and lightweight
 XML processor

* :mod:`xml.dom`: the DOM API definition
* :mod:`xml.dom.minidom`: a minimal DOM implementation
* :mod:`xml.dom.pulldom`: support for building partial DOM trees

* :mod:`xml.sax`: SAX2 base classes and convenience functions
* :mod:`xml.parsers.expat`: the Expat parser binding

.. _xml-vulnerabilities:

XML vulnerabilities
-------------------

The XML processing modules are not secure against maliciously constructed data.
An attacker can abuse XML features to carry out denial of service attacks,
access local files, generate network connections to other machines, or
circumvent firewalls.

The following table gives an overview of the known attacks and whether
the various modules are vulnerable to them.

========================= ============== =============== ============== ============== ==============
kind sax etree minidom pulldom xmlrpc
========================= ============== =============== ============== ============== ==============
billion laughs **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable**
quadratic blowup **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable**
external entity expansion Safe (4) Safe (1) Safe (2) Safe (4) Safe (3)
`DTD`_ retrieval Safe (4) Safe Safe Safe (4) Safe
decompression bomb Safe Safe Safe Safe **Vulnerable**
========================= ============== =============== ============== ============== ==============

1. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a
 :exc:`ParserError` when an entity occurs.
2. :mod:`xml.dom.minidom` doesn't expand external entities and simply returns
 the unexpanded entity verbatim.
3. :mod:`xmlrpclib` doesn't expand external entities and omits them.
4. Since Python 3.7.1, external general entities are no longer processed by
 default.

billion laughs / exponential entity expansion
 The `Billion Laughs`_ attack -- also known as exponential entity expansion --
 uses multiple levels of nested entities. Each entity refers to another entity
 several times, and the final entity definition contains a small string.
 The exponential expansion results in several gigabytes of text and
 consumes lots of memory and CPU time.

quadratic blowup entity expansion
 A quadratic blowup attack is similar to a `Billion Laughs`_ attack; it abuses
 entity expansion, too. Instead of nested entities it repeats one large entity
 with a couple of thousand chars over and over again. The attack isn't as
 efficient as the exponential case but it avoids triggering parser countermeasures
 that forbid deeply-nested entities.

external entity expansion
 Entity declarations can contain more than just text for replacement. They can
 also point to external resources or local files. The XML
 parser accesses the resource and embeds the content into the XML document.

`DTD`_ retrieval
 Some XML libraries like Python's :mod:`xml.dom.pulldom` retrieve document type
 definitions from remote or local locations. The feature has similar
 implications as the external entity expansion issue.

decompression bomb
 Decompression bombs (aka `ZIP bomb`_) apply to all XML libraries
 that can parse compressed XML streams such as gzipped HTTP streams or
 LZMA-compressed
 files. For an attacker it can reduce the amount of transmitted data by three
 magnitudes or more.

The documentation for `defusedxml`_ on PyPI has further information about
all known attack vectors with examples and references.

.. _defused-packages:

The :mod:`defusedxml` and :mod:`defusedexpat` Packages
------------------------------------------------------

`defusedxml`_ is a pure Python package with modified subclasses of all stdlib
XML parsers that prevent any potentially malicious operation. Use of this
package is recommended for any server code that parses untrusted XML data. The
package also ships with example exploits and extended documentation on more
XML exploits such as XPath injection.

`defusedexpat`_ provides a modified libexpat and a patched
:mod:`pyexpat` module that have countermeasures against entity expansion
DoS attacks. The :mod:`defusedexpat` module still allows a sane and configurable amount of entity
expansions. The modifications may be included in some future release of Python,
but will not be included in any bugfix releases of
Python because they break backward compatibility.

.. _defusedxml: https://pypi.org/project/defusedxml/
.. _defusedexpat: https://pypi.org/project/defusedexpat/
.. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs
.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
.. _DTD: https://en.wikipedia.org/wiki/Document_type_definition

一键复制编辑原始数据按行查看历史

zhangweibo 提交于 2021年11月17日 13:49 +08:00 . git init

XML Processing Modules

.. module:: xml
 :synopsis: Package containing XML processing modules

.. sectionauthor:: Christian Heimes <christian@python.org>

.. sectionauthor:: Georg Brandl <georg@python.org>

Source code: :source:`Lib/xml/`

Python's interfaces for processing XML are grouped in the xml package.

Warning

The XML modules are not secure against erroneous or maliciously constructed data. If you need to parse untrusted or unauthenticated data see the :ref:`xml-vulnerabilities` and :ref:`defused-packages` sections.

It is important to note that modules in the :mod:`xml` package require that there be at least one SAX-compliant XML parser available. The Expat parser is included with Python, so the :mod:`xml.parsers.expat` module will always be available.

The documentation for the :mod:`xml.dom` and :mod:`xml.sax` packages are the definition of the Python bindings for the DOM and SAX interfaces.

The XML handling submodules are:

:mod:`xml.etree.ElementTree`: the ElementTree API, a simple and lightweight XML processor

:mod:`xml.dom`: the DOM API definition
:mod:`xml.dom.minidom`: a minimal DOM implementation
:mod:`xml.dom.pulldom`: support for building partial DOM trees

:mod:`xml.sax`: SAX2 base classes and convenience functions
:mod:`xml.parsers.expat`: the Expat parser binding

XML vulnerabilities

The XML processing modules are not secure against maliciously constructed data. An attacker can abuse XML features to carry out denial of service attacks, access local files, generate network connections to other machines, or circumvent firewalls.

The following table gives an overview of the known attacks and whether the various modules are vulnerable to them.

kind	sax	etree	minidom	pulldom	xmlrpc
billion laughs	Vulnerable	Vulnerable	Vulnerable	Vulnerable	Vulnerable
quadratic blowup	Vulnerable	Vulnerable	Vulnerable	Vulnerable	Vulnerable
external entity expansion	Safe (4)	Safe (1)	Safe (2)	Safe (4)	Safe (3)
:mod:`xml.etree.ElementTree` doesn't expand external entities and raises a :exc:`ParserError` when an entity occurs. :mod:`xml.dom.minidom` doesn't expand external entities and simply returns the unexpanded entity verbatim. :mod:`xmlrpclib` doesn't expand external entities and omits them. Since Python 3.7.1, external general entities are no longer processed by default. billion laughs / exponential entity expansion The Billion Laughs attack; it abuses entity expansion, too. Instead of nested entities it repeats one large entity with a couple of thousand chars over and over again. The attack isn't as efficient as the exponential case but it avoids triggering parser countermeasures that forbid deeply-nested entities. external entity expansion Entity declarations can contain more than just text for replacement. They can also point to external resources or local files. The XML parser accesses the resource and embeds the content into the XML document. :mod:`xml.dom.pulldom` retrieve document type definitions from remote or local locations. The feature has similar implications as the external entity expansion issue. decompression bomb Decompression bombs (aka defusedxml on PyPI has further information about all known attack vectors with examples and references. The :mod:`defusedxml` and :mod:`defusedexpat` Packages defusedexpat provides a modified libexpat and a patched :mod:`pyexpat` module that have countermeasures against entity expansion DoS attacks. The :mod:`defusedexpat` module still allows a sane and configurable amount of entity expansions. The modifications may be included in some future release of Python, but will not be included in any bugfix releases of Python because they break backward compatibility. Loading... 跳转举报举报成功我们将于2个工作日内通过站内信反馈结果给你! 请认真填写举报原因,尽可能描述详细。举报类型请选择举报类型举报原因取消发送误判申诉此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。如您确认内容无涉及不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。取消提交简介暂无描述暂无标签 /python_sourcecode/python3.7.4/blob/master/Doc/library/xml.rst 未知许可证查看未知开源许可协议 0 Stars 1 Watching 0 Forks 取消发行版暂无发行版贡献者全部语言 Python 59.0% C 38.8% C++ 0.7% HTML 0.4% M4 0.4% Other 0.7% 近期动态不能加载更多了编辑仓库简介简介内容主页马建仓 AI 助手尝试更多代码解读代码找茬代码优化 1 https://gitee.com/python_sourcecode/python3.7.4.git git@gitee.com:python_sourcecode/python3.7.4.git python_sourcecode python3.7.4 python3.7.4 master 北京奥思研工智能科技有限公司版权所有 Git 大全 Git 命令学习 CopyCat 代码克隆检测 APP与插件下载 Gitee 封面人物 GVP 项目 Gitee 博客 Gitee 公益计划 Gitee 持续集成 OpenAPI MCP Server 帮助文档在线自助服务更新日志关于我们加入我们使用条款意见建议合作伙伴技术交流QQ群技术交流QQ群微信服务号微信服务号 client#oschina.cn 企业版在线使用:400-606-0201 专业版私有部署: 赖经理 13058176526 开放原子开源基金会开放原子开源基金会合作代码托管平台违法和不良信息举报中心违法和不良信息举报中心京ICP备2025119063号京公网安备11011502039387号京公网安备11011502039387号简体 / 繁體 / English 点此查找更多帮助搜索帮助 Git 命令在线学习如何在 Gitee 导入 GitHub 仓库 Git 仓库基础操作企业版和社区版功能对比 SSH 公钥设置如何处理代码冲突仓库体积过大,如何减小? 如何找回被删除的仓库数据 Gitee 产品配额说明 GitHub仓库快速导入Gitee及同步更新什么是 Release(发行版) 将 PHP 项目自动发布到 packagist.org 评论仓库举报回到顶部登录提示该操作需登录 Gitee 帐号,请先登录后再操作。立即登录没有帐号,去注册 AltStyle によって変換されたページ (->オリジナル) / アドレス: モード:

source-code-analysis/python3.7.4

XML Processing Modules

XML vulnerabilities

The :mod:`defusedxml` and :mod:`defusedexpat` Packages

简介

发行版

贡献者

语言

近期动态

搜索帮助