René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Consider using defusedxml instead of  lxml.etree to avoid certain XML attacks.","articleBody":"I ran a quick bandit scan against python-stix and observed the following issues. Most are medium/low severity, though.\r\n\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/extensions/test_mechanism/open_ioc_2010_test_mechanism.py:95\r\n94\t            parser = mixbox.xml.get_xml_parser()\r\n95\t            return_obj.ioc = etree.parse(BytesIO(d['ioc']), parser=parser)\r\n96\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B410:blacklist] Using etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace etree with the equivalent defusedxml package.\r\n   Severity: Low   Confidence: High\r\n   Location: python-stix/stix/test/extensions/malware/maec_4_1_malware_test.py:5\r\n4\r\n5\tfrom lxml import etree\r\n6\timport mixbox.xml\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/malware/maec_4_1_malware_test.py:86\r\n85\t        parser = mixbox.xml.get_xml_parser()\r\n86\t        tree = etree.parse(BytesIO(xml), parser=parser)\r\n87\t        root = tree.getroot()\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/malware/maec_4_1_malware_test.py:99\r\n98\t        parser = mixbox.xml.get_xml_parser()\r\n99\t        tree = etree.parse(StringIO(self.XML), parser=parser)\r\n100\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/malware/maec_4_1_malware_test.py:108\r\n107\t        parser = mixbox.xml.get_xml_parser()\r\n108\t        tree = etree.parse(StringIO(self.XML), parser=parser)\r\n109\t        ext = MAECInstance()\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B410:blacklist] Using lxml to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml with the equivalent defusedxml package.\r\n   Severity: Low   Confidence: High\r\n   Location: python-stix/stix/test/extensions/test_mechanisms/openioc_test.py:6\r\n5\r\n6\timport lxml\r\n7\r\n8\tfrom mixbox import idgen\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/test_mechanisms/openioc_test.py:132\r\n131\t        parser = mixbox.xml.get_xml_parser()\r\n132\t        tree = lxml.etree.parse(BytesIO(xml), parser=parser)\r\n133\t        root = tree.getroot()\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/test_mechanisms/openioc_test.py:144\r\n143\t        parser = mixbox.xml.get_xml_parser()\r\n144\t        tree = lxml.etree.parse(StringIO(self.XML), parser=parser)\r\n145\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.parse with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/test/extensions/test_mechanisms/openioc_test.py:152\r\n151\t        parser = mixbox.xml.get_xml_parser()\r\n152\t        tree = lxml.etree.parse(StringIO(self.XML), parser=parser)\r\n153\t        ext = OpenIOCTestMechanism()\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B410:blacklist] Using lxml.etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree with the equivalent defusedxml package.\r\n   Severity: Low   Confidence: High\r\n   Location: python-stix/stix/test/utils/nsparser_test.py:8\r\n7\t# external\r\n8\timport lxml.etree\r\n9\tfrom mixbox.vendor.six import StringIO\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B410:blacklist] Using lxml.etree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree with the equivalent defusedxml package.\r\n   Severity: Low   Confidence: High\r\n   Location: python-stix/stix/utils/__init__.py:9\r\n8\r\n9\timport lxml.etree\r\n10\r\n11\tfrom mixbox.entities import Entity, EntityList\r\n\r\n--------------------------------------------------\r\n\u003e\u003e Issue: [B320:blacklist] Using lxml.etree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.etree.fromstring with its defusedxml equivalent function.\r\n   Severity: Medium   Confidence: High\r\n   Location: python-stix/stix/utils/__init__.py:108\r\n107\t    xml = \"\u003ce\u003e{0}\u003c/e\u003e\".format(text)\r\n108\t    node = lxml.etree.fromstring(xml)\r\n109\t    return node.text","author":{"url":"https://github.com/santosomar","@type":"Person","name":"santosomar"},"datePublished":"2016-11-23T04:27:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/312/python-stix/issues/312"}