defusedxml

When using lxml, avoid using Python string formatting to build XPath queries, as this makes your application vulnerable to XPath injection (similar to SQL injection). Instead, use parameterized XPath queries provided by the .xpath() method. This ensures that arguments are properly quoted and validated.

# DON'T
>>> tree.xpath("/tag[@id='%s']" % value)

# instead do
>>> tree.xpath("/tag[@id=$tagid]", tagid=name)

You can verify if your Python environment has built-in mitigations against XML bombs by checking the Python version and the libexpat version via pyexpat.

Mitigations are generally present if:

1. Python version is $\ge$ 3.7.1, 3.8.12, 3.9.7, or 3.10.0 (August 2021).
2. libexpat version is $\ge$ 2.4.0.

import sys
import pyexpat

has_mitigations = (
    sys.version_info >= (3, 7, 1) and
    pyexpat.version_info >= (2, 4, 0)
)

To protect your application from XML-based attacks (like Billion Laughs, quadratic blowup, or external entity expansion), replace your standard library XML imports with the corresponding defusedxml modules.

Note: defusedxml modules are not drop-in replacements for all features. They focus on secure parsing and loading. For other XML operations (like creating elements or converting to strings), use the original standard library classes/functions in conjunction with the objects returned by defusedxml.

# Instead of:
# from xml.etree.ElementTree import parse
# et = parse(xmlfile)

# Use:
from defusedxml.ElementTree import parse
et = parse(xmlfile)

To protect your application from XML vulnerabilities (like XML bombs), replace standard library XML imports with the corresponding defusedxml modules.

Important: defusedxml modules are not drop-in replacements for the entire standard library. They only provide functions and classes for parsing and loading. For all other operations (like manipulating elements, creating new elements, or converting to strings), use the original xml.etree.ElementTree (or other stdlib) classes and functions.

Example of correct usage:

from defusedxml import ElementTree as DET
from xml.etree.ElementTree as ET

# Use defusedxml for parsing
root = DET.fromstring("<root/>")

# Use stdlib for manipulation and serialization
root.append(ET.Element("item"))
print(ET.tostring(root))

To prevent XML Denial of Service (DoS) attacks in .NET, configure XmlReaderSettings to prohibit DTDs, limit entity expansion, and nullify the XmlResolver.

XmlReaderSettings settings = new XmlReaderSettings();
settings.ProhibitDtd = false;
settings.MaxCharactersFromEntities = 1024;
settings.XmlResolver = null;
XmlReader reader = XmlReader.Create(stream, settings);

To protect Ruby's REXML parser from entity expansion attacks (both quadratic and exponential), you must manually disable the feature by setting the entity_expansion_limit to 0.

REXML::Document.entity_expansion_limit = 0

The defusedxml.xmlrpc module provides a monkey patch for the standard library's xmlrpc package (Python 3.x) or xmlrpclib (Python 2.x). This patch protects against XML attacks, decompression bombs, and excessively large requests/responses.

• Default Limit: 30 MB for requests, responses, and gzip decompression.
• Customizing Limits: Modify the MAX_DATA module variable. Setting it to -1 disables the limit.
• Control: Use monkey_patch() to enable fixes and unmonkey_patch() to revert to the original state.

The defusedxml.xmlrpc module uses a monkey patch to protect against XML attacks and decompression bombs.

• Use monkey_patch() to enable protection.
• Use unmonkey_patch() to revert to the original state.
• The default limit for requests, responses, and gzip decompression is 30 MB.
• You can modify this limit by changing the MAX_DATA module variable. Setting MAX_DATA = -1 disables the limit.

While lxml is inherently safer than many parsers (it has built-in mitigations for Billion Laughs and quadratic blowup), the defusedxml.lxml module provides an example of how to wrap it securely.

Note: This module is deprecated and will be removed in a future release.

To manually secure lxml without this module, you can use a custom parser object with resolve_entities=False:

from lxml import etree

parser = etree.XMLParser(resolve_entities=False)
root = etree.fromstring("<example/>", parser=parser)