I am writing a suite of Python 3 applications (including first a command line utility, second an
HTTP(S) proxy) which deal with XML.
Today I've discovered that there are several vulnerabilities related to XML.
My main question: Is it worth to entirely switch to defusedxml? I don't think it is necessary for non-DoS attacks (such as access to local files through SYSTEM entities). So
defusedxml is necessary only against DoS attacks, right?
If it were for the command line utility only, for such attacks as billion laughs, it would be enabled to run my program under
But despite I am now focused on the command line utility, I want my current work to be used in the multi-user
HTTP(S) proxy, which I am going to write too.
Is it true that to make the proxy, I need to use
defusedxml to protect against billion laughs and similar attacks? Then will (after I use
defusedxml) it be enough to limit the size of downloaded XML files? Or do I need some (which?) more advanced counter-measures? Or some other kind of countermeasures?