I saw something like a regression in some case, or maybe I'm misusing
the library:
>>> from io import BytesIO
>>> from lxml import etree
>>> xml='''<root>
... <child name='one' />
... <child name='two' />
... </root>
... '''
>>> document = etree.iterparse(BytesIO(xml), events=('end',), tag='root')
>>> for action, elem in document:
... print("%s: %s" % (action, elem.tag))
...
end: root
>>> file('/tmp/test.xml', 'w').write(xml)
>>> document = etree.iterparse('/tmp/test.xml', events=('end',), tag='root')
>>> for action, elem in document:
... print("%s: %s" % (action, elem.tag))
...
end: root
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "iterparse.pxi", line 478, in lxml.etree.iterparse.__next__
(src/lxml/lxml.etree.c:98432)
File "iterparse.pxi", line 530, in lxml.etree.iterparse._read_more_events
(src/lxml/lxml.etree.c:98953)
File "parser.pxi", line 601, in lxml.etree._raiseParseError
(src/lxml/lxml.etree.c:74863)
lxml.etree.XMLSyntaxError: None
Downgrading libxml2 version 2.7.8.dfsg-5.1ubuntu4 does not finish in a
traceback when parsing from a file.
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to libxml2 in Ubuntu.
https://bugs.launchpad.net/bugs/1194410
Title:
Apply upstream patch to close XXE vulnerability in precise
Status in “libxml2” package in Ubuntu:
Fix Released
Status in “libxml2” source package in Lucid:
Fix Released
Status in “libxml2” source package in Precise:
Fix Released
Status in “libxml2” source package in Quantal:
Fix Released
Status in “libxml2” source package in Raring:
Fix Released
Status in “libxml2” source package in Saucy:
Fix Released
Bug description:
In version 2.7.8 there is no way to avoid opening and reading a file
if it is specified in the ENTITY section of the document.
The issue has been raised in:
https://mail.gnome.org/archives/xml/2012-October/msg00002.html
https://github.com/sparklemotion/nokogiri/issues/693
An upstream fix has been released:
https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/1194410/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : desktop-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
