defusedxml still required?

[stefan6419846]

In #5, defusedxml has been introduced as a dependency to prevent XEE attacks.

According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:

• https://docs.python.org/3/library/xml.html#xml-security
• https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762

According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.

Is the dependency still required here?

[jkowalleck]

feel free to open a (draft) pull-request needed changes, introducing a native XML parser with properly hardened config ala defusedXML.

[stefan6419846]

introducing a native XML parser with properly hardened config

As far as I understand the official docs, recent official Python builds are hardened against these attacks automatically, thus just reverting the aforementioned PR would solve this issue.

Given that at most automated scanners still treat XML parsing without defusedxml as bad, simply reverting the PR might not be desired, thus I decided to open an issue about it to discuss the topic.

[jkowalleck]

recent official Python builds are hardened against these attacks automatically

per default config i'd guess?
we then should manually apply this hardened config in our code, so that SourceCodeAnalyzers see them properly applied.

[stefan6419846]

This requires using/linking a recent Expat version to Python, which the official builds do, but might not be the case for custom builds. Further hardening should not be required.

The source code analyzers I am aware of simply check the imports and flag all direct xml.etree imports as possibly vulnerable, thus the only way would be to silence the corresponding error codes with a proper explanation.