[issue24238] Avoid entity expansion attacks in Element Tree

Martin Panter added the comment: Today I discovered that Christian’s defusedxml project already does the same sort of thing. The difference is he calls the parameter forbid_entities. So I have updated my patch and changed the name from reject_entities to forbid_entities for compatibility. ---

[issue24238] Avoid entity expansion attacks in Element Tree

Changes by Serhiy Storchaka : -- nosy: +serhiy.storchaka stage: -> patch review ___ Python tracker ___ ___ Python-bugs-list mailing l

[issue24238] Avoid entity expansion attacks in Element Tree

New submission from Martin Panter: This patch could be the basis of an alternative to Christian Heimes’s patch in Issue 17239. It adds a parser flag to the Element Tree modules so that they will immediately raise an exception when an entity declaration is encountered. I believe this should be