1

I am writing a suite of Python 3 applications (including first a command line utility, second an HTTP(S) proxy) which deal with XML.

Today I've discovered that there are several vulnerabilities related to XML.

My main question: Is it worth to entirely switch to defusedxml? I don't think it is necessary for non-DoS attacks (such as access to local files through SYSTEM entities). So defusedxml is necessary only against DoS attacks, right?

If it were for the command line utility only, for such attacks as billion laughs, it would be enabled to run my program under ulimit.

But despite I am now focused on the command line utility, I want my current work to be used in the multi-user HTTP(S) proxy, which I am going to write too.

Is it true that to make the proxy, I need to use defusedxml to protect against billion laughs and similar attacks? Then will (after I use defusedxml) it be enough to limit the size of downloaded XML files? Or do I need some (which?) more advanced counter-measures? Or some other kind of countermeasures?

4

Is it worth to entirely switch to defusedxml?

Whether it is worth it not only depends on the threat that is mitigated but also how much extra work it is for you to use defusedxml instead of any other library. While I can give you security advise, only you can answer that question.

I consider XXE (XML External Entity (XXE) Processing ) a more serious problem than billion laugs. XXE may expose files on the local filesystem by defining entities that read files:

<?xml version="1.0" encoding="ISO-8859-1"?>
  <!DOCTYPE foo [  
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>

For many XML libraries, it is possible to disable DOCTYPE handling or entity expansion, and that would make handling untrusted XML safe. The advantage of defusedxml is that it comes with the secure settings by default, and you don't have to worry about that.

Don't base your security on XML validation or sanitation before parsing it. Creating a regex filter that recognizes XML entities that cannot by bypassed by the attacker is close to impossible.

I need to use defusedxml to protect against billion laughs and similar attacks?

Most libraries can be configured to protect against XML attacks. You don't need to use defusedxml.

Then will (after I use defusedxml) it be enough to limit the size of downloaded XML files?

Using defusedxml or disabling the DOCTYPE and entity expansion features will make the XML behave more like you would expect. Limiting the size is a good idea, but not strictly necessary. The power of billion laughs is that it takes up a lot of server resources with a little of the client's resources. A normal XML will take about as much server resources as client resources.

Or do I need some (which?) more advanced counter-measures? Or some other kind of countermeasures?

Not for XML related vulnerabilities, no.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.