Kaydet (Commit) e1478e4a authored tarafından Guido van Rossum's avatar Guido van Rossum

Issue #18789: Update XML vulnerability table to use Safe/Vulnerable instead of No/Yes.

üst 4a452352
...@@ -60,15 +60,15 @@ circumvent firewalls. ...@@ -60,15 +60,15 @@ circumvent firewalls.
The following table gives an overview of the known attacks and whether The following table gives an overview of the known attacks and whether
the various modules are vulnerable to them. the various modules are vulnerable to them.
========================= ======== ========= ========= ======== ========= ========================= ============== =============== ============== ============== ==============
kind sax etree minidom pulldom xmlrpc kind sax etree minidom pulldom xmlrpc
========================= ======== ========= ========= ======== ========= ========================= ============== =============== ============== ============== ==============
billion laughs **Yes** **Yes** **Yes** **Yes** **Yes** billion laughs **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable**
quadratic blowup **Yes** **Yes** **Yes** **Yes** **Yes** quadratic blowup **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable** **Vulnerable**
external entity expansion **Yes** No (1) No (2) **Yes** No (3) external entity expansion **Vulnerable** Safe (1) Safe (2) **Vulnerable** Safe (3)
`DTD`_ retrieval **Yes** No No **Yes** No `DTD`_ retrieval **Vulnerable** Safe Safe **Vulnerable** Safe
decompression bomb No No No No **Yes** decompression bomb Safe Safe Safe Safe **Vulnerable**
========================= ======== ========= ========= ======== ========= ========================= ============== =============== ============== ============== ==============
1. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a 1. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a
:exc:`ParserError` when an entity occurs. :exc:`ParserError` when an entity occurs.
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment