Skip to content

Commit 39ba833

Browse files
committed
Remove warning and defusedxml
1 parent 2fb6d1f commit 39ba833

1 file changed

Lines changed: 0 additions & 22 deletions

File tree

Doc/library/xml.rst

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,6 @@ XML Processing Modules
1515

1616
Python's interfaces for processing XML are grouped in the ``xml`` package.
1717

18-
.. warning::
19-
20-
The XML modules are not secure against erroneous or maliciously
21-
constructed data. If you need to parse untrusted or
22-
unauthenticated data see the :ref:`xml-vulnerabilities` and
23-
:ref:`defusedxml-package` sections.
24-
2518
It is important to note that modules in the :mod:`xml` package require that
2619
there be at least one SAX-compliant XML parser available. The Expat parser is
2720
included with Python, so the :mod:`xml.parsers.expat` module will always be
@@ -126,21 +119,6 @@ large tokens
126119
be used to cause denial of service in the application parsing XML.
127120
The issue is known as :cve:`2023-52425`.
128121

129-
The documentation for :pypi:`defusedxml` on PyPI has further information about
130-
all known attack vectors with examples and references.
131-
132-
.. _defusedxml-package:
133-
134-
The :mod:`!defusedxml` Package
135-
------------------------------
136-
137-
:pypi:`defusedxml` is a pure Python package with modified subclasses of all stdlib
138-
XML parsers that prevent any potentially malicious operation. Use of this
139-
package is recommended for any server code that parses untrusted XML data. The
140-
package also ships with example exploits and extended documentation on more
141-
XML exploits such as XPath injection.
142-
143-
144122
.. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs
145123
.. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
146124
.. _DTD: https://en.wikipedia.org/wiki/Document_type_definition

0 commit comments

Comments
 (0)