@@ -15,13 +15,6 @@ XML Processing Modules
1515
1616Python's interfaces for processing XML are grouped in the ``xml `` package.
1717
18- .. warning ::
19-
20- The XML modules are not secure against erroneous or maliciously
21- constructed data. If you need to parse untrusted or
22- unauthenticated data see the :ref: `xml-vulnerabilities ` and
23- :ref: `defusedxml-package ` sections.
24-
2518It is important to note that modules in the :mod: `xml ` package require that
2619there be at least one SAX-compliant XML parser available. The Expat parser is
2720included with Python, so the :mod: `xml.parsers.expat ` module will always be
@@ -126,21 +119,6 @@ large tokens
126119 be used to cause denial of service in the application parsing XML.
127120 The issue is known as :cve: `2023-52425 `.
128121
129- The documentation for :pypi: `defusedxml ` on PyPI has further information about
130- all known attack vectors with examples and references.
131-
132- .. _defusedxml-package :
133-
134- The :mod: `!defusedxml ` Package
135- ------------------------------
136-
137- :pypi: `defusedxml ` is a pure Python package with modified subclasses of all stdlib
138- XML parsers that prevent any potentially malicious operation. Use of this
139- package is recommended for any server code that parses untrusted XML data. The
140- package also ships with example exploits and extended documentation on more
141- XML exploits such as XPath injection.
142-
143-
144122.. _Billion Laughs : https://en.wikipedia.org/wiki/Billion_laughs
145123.. _ZIP bomb : https://en.wikipedia.org/wiki/Zip_bomb
146124.. _DTD : https://en.wikipedia.org/wiki/Document_type_definition
0 commit comments