Skip to content

Use Safe Parsers in lxml Parsing Functions#4

Open
pixeebot[bot] wants to merge 1 commit intomasterfrom
pixeebot/drip-2025-08-03-pixee-python/safe-lxml-parsing
Open

Use Safe Parsers in lxml Parsing Functions#4
pixeebot[bot] wants to merge 1 commit intomasterfrom
pixeebot/drip-2025-08-03-pixee-python/safe-lxml-parsing

Conversation

@pixeebot
Copy link
Copy Markdown

@pixeebot pixeebot bot commented Aug 3, 2025

This codemod sets the parser parameter in calls to lxml.etree.parse and lxml.etree.fromstring if omitted or set to None (the default value). Unfortunately, the default parser=None means lxml will rely on an unsafe parser, making your code potentially vulnerable to entity expansion attacks and external entity (XXE) attacks.

The changes look as follows:

  import lxml.etree
- lxml.etree.parse("path_to_file")
- lxml.etree.fromstring("xml_str")
+ lxml.etree.parse("path_to_file", parser=lxml.etree.XMLParser(resolve_entities=False))
+ lxml.etree.fromstring("xml_str", parser=lxml.etree.XMLParser(resolve_entities=False))
More reading

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:python/safe-lxml-parsing

@pixeebot
Copy link
Copy Markdown
Author

pixeebot bot commented Aug 11, 2025

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

@pixeebot
Copy link
Copy Markdown
Author

pixeebot bot commented Aug 12, 2025

Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants