view roundup/anypy/xmlrpc_.py @ 8237:57325fea9982

issue2551116 - Replace xmlrpclib (xmlrpc.client) with defusedxml. defusedxml will be used to moneypatch the problematic client and server modules. Test added using an xml bomb.
author John Rouillard <rouilj@ieee.org>
date Sun, 29 Dec 2024 19:11:01 -0500
parents 7b33365ccb2a
children 05405220dc38
line wrap: on
line source

try:
    # Python 3+.
    from xmlrpc import client, server
    # If client.defusedxml == False, client.py will warn that
    # xmlrpc is insecure and defusedxml should be installed.
    client.defusedxml=False
    try:
        from defusedxml import xmlrpc
        xmlrpc.monkey_patch()
        # figure out how to allow user to set xmlrpc.MAX_DATA = bytes
        client.defusedxml=True
    except ImportError:
        # use regular xmlrpc with warnings
        pass

    server.SimpleXMLRPCDispatcher
except (ImportError, AttributeError):
    # Python 2.
    import SimpleXMLRPCServer as server
    import xmlrpclib as client  # noqa: F401

Roundup Issue Tracker: http://roundup-tracker.org/