ElementTree.py 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112
  1. # defusedxml
  2. #
  3. # Copyright (c) 2013 by Christian Heimes <christian@python.org>
  4. # Licensed to PSF under a Contributor Agreement.
  5. # See http://www.python.org/psf/license for licensing details.
  6. """Defused xml.etree.ElementTree facade
  7. """
  8. from __future__ import print_function, absolute_import
  9. import sys
  10. from .common import PY3, PY26, PY31
  11. if PY3:
  12. import importlib
  13. else:
  14. from xml.etree.ElementTree import XMLParser as _XMLParser
  15. from xml.etree.ElementTree import iterparse as _iterparse
  16. if PY26:
  17. from xml.parsers.expat import ExpatError as ParseError
  18. else:
  19. from xml.etree.ElementTree import ParseError
  20. _IterParseIterator = None
  21. from xml.etree.ElementTree import TreeBuilder as _TreeBuilder
  22. from xml.etree.ElementTree import parse as _parse
  23. from xml.etree.ElementTree import tostring
  24. from .common import (DTDForbidden, EntitiesForbidden,
  25. ExternalReferenceForbidden, _generate_etree_functions)
  26. __origin__ = "xml.etree.ElementTree"
  27. def _get_py3_cls():
  28. """Python 3.3 hides the pure Python code but defusedxml requires it.
  29. The code is based on test.support.import_fresh_module().
  30. """
  31. pymodname = "xml.etree.ElementTree"
  32. cmodname = "_elementtree"
  33. pymod = sys.modules.pop(pymodname, None)
  34. cmod = sys.modules.pop(cmodname, None)
  35. sys.modules[cmodname] = None
  36. pure_pymod = importlib.import_module(pymodname)
  37. if cmod is not None:
  38. sys.modules[cmodname] = cmod
  39. else:
  40. sys.modules.pop(cmodname)
  41. sys.modules[pymodname] = pymod
  42. _XMLParser = pure_pymod.XMLParser
  43. _iterparse = pure_pymod.iterparse
  44. if PY31:
  45. _IterParseIterator = None
  46. from xml.parsers.expat import ExpatError as ParseError
  47. else:
  48. _IterParseIterator = pure_pymod._IterParseIterator
  49. ParseError = pure_pymod.ParseError
  50. return _XMLParser, _iterparse, _IterParseIterator, ParseError
  51. if PY3:
  52. _XMLParser, _iterparse, _IterParseIterator, ParseError = _get_py3_cls()
  53. class DefusedXMLParser(_XMLParser):
  54. def __init__(self, html=0, target=None, encoding=None,
  55. forbid_dtd=False, forbid_entities=True,
  56. forbid_external=True):
  57. if PY26 or PY31:
  58. _XMLParser.__init__(self, html, target)
  59. else:
  60. # Python 2.x old style class
  61. _XMLParser.__init__(self, html, target, encoding)
  62. self.forbid_dtd = forbid_dtd
  63. self.forbid_entities = forbid_entities
  64. self.forbid_external = forbid_external
  65. if PY3 and not PY31:
  66. parser = self.parser
  67. else:
  68. parser = self._parser
  69. if self.forbid_dtd:
  70. parser.StartDoctypeDeclHandler = self.defused_start_doctype_decl
  71. if self.forbid_entities:
  72. parser.EntityDeclHandler = self.defused_entity_decl
  73. parser.UnparsedEntityDeclHandler = self.defused_unparsed_entity_decl
  74. if self.forbid_external:
  75. parser.ExternalEntityRefHandler = self.defused_external_entity_ref_handler
  76. def defused_start_doctype_decl(self, name, sysid, pubid,
  77. has_internal_subset):
  78. raise DTDForbidden(name, sysid, pubid)
  79. def defused_entity_decl(self, name, is_parameter_entity, value, base,
  80. sysid, pubid, notation_name):
  81. raise EntitiesForbidden(name, value, base, sysid, pubid, notation_name)
  82. def defused_unparsed_entity_decl(self, name, base, sysid, pubid,
  83. notation_name):
  84. # expat 1.2
  85. raise EntitiesForbidden(name, None, base, sysid, pubid, notation_name)
  86. def defused_external_entity_ref_handler(self, context, base, sysid,
  87. pubid):
  88. raise ExternalReferenceForbidden(context, base, sysid, pubid)
  89. # aliases
  90. XMLTreeBuilder = XMLParse = DefusedXMLParser
  91. parse, iterparse, fromstring = _generate_etree_functions(DefusedXMLParser,
  92. _TreeBuilder, _IterParseIterator, _parse, _iterparse)
  93. XML = fromstring