xml.etree.ElementTree is the stdlib XML parser. The C-accelerated parser has some built-in protections but still processes external entities in some configurations — XXE sink. Prefer defusedxml for untrusted XML.
.parse().fromstring().XMLParser().parse()Sinkxml.etree.ElementTree.parse(source, parser=None) -> ElementTree
Parses an XML file. XXE sink under certain Python versions / custom parsers.
0.fromstring()Sinkxml.etree.ElementTree.fromstring(text, parser=None) -> Element
Parses XML from a string. Same XXE considerations as parse().
0.XMLParser()Sinkxml.etree.ElementTree.XMLParser(*, target=None, encoding=None) -> XMLParser
Custom parser. Pair with untrusted input to produce XXE.
| FQN | Field | |
|---|---|---|
| xml.etree.ElementTree | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyXmlEtree