[tryton-commits] changeset in proteus:6.2 Protect against XML vulnerabilities

[Cédric Krier]

changeset e4019b6ca238 in proteus:6.2
details: https://hg.tryton.org/proteus?cmd=changeset&node=e4019b6ca238
description:
        Protect against XML vulnerabilities

        issue11219
        issue11244
        (grafted from f801a89c84e7df1e3ae00b0f91d500ed7d36a7a9)
diffstat:

 CHANGELOG         |  2 ++
 proteus/config.py |  4 ++++
 setup.py          |  1 +
 3 files changed, 7 insertions(+), 0 deletions(-)

diffs (36 lines):

diff -r 098b02e63697 -r e4019b6ca238 CHANGELOG
--- a/CHANGELOG Sat Jan 15 16:12:15 2022 +0100
+++ b/CHANGELOG Tue Mar 01 19:07:56 2022 +0100
@@ -1,3 +1,5 @@
+* Use defusedxml to parse XML (11244)
+
 Version 6.2.1 - 2022-01-15
 * Bug fixes (see mercurial logs for details)
 
diff -r 098b02e63697 -r e4019b6ca238 proteus/config.py
--- a/proteus/config.py Sat Jan 15 16:12:15 2022 +0100
+++ b/proteus/config.py Tue Mar 01 19:07:56 2022 +0100
@@ -13,8 +13,12 @@
 from decimal import Decimal
 from contextlib import contextmanager
 
+import defusedxml.xmlrpc
+
 __all__ = ['set_trytond', 'set_xmlrpc', 'get_config']
 
+defusedxml.xmlrpc.monkey_patch()
+
 
 def dump_decimal(self, value, write):
     write('<value><bigdecimal>')
diff -r 098b02e63697 -r e4019b6ca238 setup.py
--- a/setup.py  Sat Jan 15 16:12:15 2022 +0100
+++ b/setup.py  Tue Mar 01 19:07:56 2022 +0100
@@ -98,6 +98,7 @@
     license='LGPL-3',
     python_requires='>=3.6',
     install_requires=[
+        'defusedxml',
         "python-dateutil",
         ],
     extras_require={