Deserialization

PyXmlEtree

xml.etree.ElementTree is the stdlib XML parser. The C-accelerated parser has some built-in protections but still processes external entities in some configurations — XXE sink. Prefer defusedxml for untrusted XML.

3 sinks
Taint flow0 sources 3 sinks
Sinks — dangerous call
.parse()
.fromstring()
.XMLParser()

Sinks

.parse()Sink
#
Signature
xml.etree.ElementTree.parse(source, parser=None) -> ElementTree

Parses an XML file. XXE sink under certain Python versions / custom parsers.

tracks:0
.fromstring()Sink
#
Signature
xml.etree.ElementTree.fromstring(text, parser=None) -> Element

Parses XML from a string. Same XXE considerations as parse().

tracks:0
.XMLParser()Sink
#
Signature
xml.etree.ElementTree.XMLParser(*, target=None, encoding=None) -> XMLParser

Custom parser. Pair with untrusted input to produce XXE.

Fully-Qualified Names

FQNField
xml.etree.ElementTreefqns[0]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

rule.py
from codepathfinder.go_rule import PyXmlEtree