defusedxml

library0.7.1pypypi✓ verified 27d ago

DefusedXML provides XML bomb protection for Python standard library modules, currently at version 0.7.1. The library aims to prevent denial of service attacks by handling malicious XML documents safely.

auth-security

pip install defusedxml

github ↗package ↗

INSTALL

IMPORT

SIG · DEFUSEDXML

defusedxml

auth-securitypythonv0.7.1

Install

1.6s avg

Import

10ms

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.7.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.004s · 17.9MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.6s · import 0.000s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

defuse_stdlib

✓ from defusedxml import defuse_stdlib

✗ from defusedxml.ElementTree import ElementTree

DefusedXmlException

✓ from defusedxml import DefusedXmlException

DTDForbidden

✓ from defusedxml import DTDForbidden

Quickly parse XML data using defusedxml to prevent XXE attacks.

from defusedxml.ElementTree import fromstring xml_data = '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' try: root = fromstring(xml_data) print(root) except Exception as e: print(str(e))

Debug

Known issues

breakingSupport for Python 2 will be removed in version 0.8.0.

fix

Upgrade to Python 3 for future compatibility.

affects: < 0.8.0

breakingThe defusedxml.cElementTree module is deprecated and may lead to `EntitiesForbidden` errors or XXE vulnerabilities when parsing untrusted XML. Use `defusedxml.ElementTree` for safer XML parsing.

fix

Use defusedxml.ElementTree instead to mitigate `EntitiesForbidden` errors and XXE vulnerabilities.

affects: >= 0.7.0

breakingParsing of XML with external entities (XXE) attempting to access local files (e.g., file:///etc/passwd) is blocked by defusedxml, resulting in an EntitiesForbidden error.

fix

Ensure XML inputs are sanitized to remove untrusted external entity declarations, or explicitly configure defusedxml to allow specific external entities if intended (use with caution for untrusted inputs).

affects: >= 0.1.0

Upgrade

Version history

0.7.1latest on PyPI · released Mar 8, 2021

Audit

Dependencies

No dependency data recorded yet.

Agent activity

27 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/tiran/defusedxml ↗

packagehttps://pypi.org/project/defusedxml/ ↗