Deserialization

PyXmltodict

xmltodict parses XML into nested dicts (uses expat under the hood). Entity expansion is disabled by default, but the module's parse() still exposes untrusted XML to the app. Not a full XXE defense.

1 source
Taint flow1 source 0 sinks
Sources — untrusted input
.parse()

Sources

.parse()Source
#
Signature
xmltodict.parse(xml_input, encoding=None, expat=expat, process_namespaces=False, ...) -> dict

Parses XML to dict. Source for user-controlled XML content.

tracks:return

Fully-Qualified Names

FQNField
xmltodictfqns[0]

Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.

Import

rule.py
from codepathfinder.go_rule import PyXmltodict