lxml.py 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149
  1. # defusedxml
  2. #
  3. # Copyright (c) 2013 by Christian Heimes <christian@python.org>
  4. # Licensed to PSF under a Contributor Agreement.
  5. # See http://www.python.org/psf/license for licensing details.
  6. """Example code for lxml.etree protection
  7. The code has NO protection against decompression bombs.
  8. """
  9. from __future__ import print_function, absolute_import
  10. import threading
  11. from lxml import etree as _etree
  12. from .common import DTDForbidden, EntitiesForbidden, NotSupportedError
  13. LXML3 = _etree.LXML_VERSION[0] >= 3
  14. __origin__ = "lxml.etree"
  15. tostring = _etree.tostring
  16. class RestrictedElement(_etree.ElementBase):
  17. """A restricted Element class that filters out instances of some classes
  18. """
  19. __slots__ = ()
  20. # blacklist = (etree._Entity, etree._ProcessingInstruction, etree._Comment)
  21. blacklist = _etree._Entity
  22. def _filter(self, iterator):
  23. blacklist = self.blacklist
  24. for child in iterator:
  25. if isinstance(child, blacklist):
  26. continue
  27. yield child
  28. def __iter__(self):
  29. iterator = super(RestrictedElement, self).__iter__()
  30. return self._filter(iterator)
  31. def iterchildren(self, tag=None, reversed=False):
  32. iterator = super(RestrictedElement, self).iterchildren(tag=tag, reversed=reversed)
  33. return self._filter(iterator)
  34. def iter(self, tag=None, *tags):
  35. iterator = super(RestrictedElement, self).iter(tag=tag, *tags)
  36. return self._filter(iterator)
  37. def iterdescendants(self, tag=None, *tags):
  38. iterator = super(RestrictedElement, self).iterdescendants(tag=tag, *tags)
  39. return self._filter(iterator)
  40. def itersiblings(self, tag=None, preceding=False):
  41. iterator = super(RestrictedElement, self).itersiblings(tag=tag, preceding=preceding)
  42. return self._filter(iterator)
  43. def getchildren(self):
  44. iterator = super(RestrictedElement, self).__iter__()
  45. return list(self._filter(iterator))
  46. def getiterator(self, tag=None):
  47. iterator = super(RestrictedElement, self).getiterator(tag)
  48. return self._filter(iterator)
  49. class GlobalParserTLS(threading.local):
  50. """Thread local context for custom parser instances
  51. """
  52. parser_config = {
  53. 'resolve_entities': False,
  54. #'remove_comments': True,
  55. #'remove_pis': True,
  56. }
  57. element_class = RestrictedElement
  58. def createDefaultParser(self):
  59. parser = _etree.XMLParser(**self.parser_config)
  60. element_class = self.element_class
  61. if self.element_class is not None:
  62. lookup = _etree.ElementDefaultClassLookup(element=element_class)
  63. parser.set_element_class_lookup(lookup)
  64. return parser
  65. def setDefaultParser(self, parser):
  66. self._default_parser = parser
  67. def getDefaultParser(self):
  68. parser = getattr(self, "_default_parser", None)
  69. if parser is None:
  70. parser = self.createDefaultParser()
  71. self.setDefaultParser(parser)
  72. return parser
  73. _parser_tls = GlobalParserTLS()
  74. getDefaultParser = _parser_tls.getDefaultParser
  75. def check_docinfo(elementtree, forbid_dtd=False, forbid_entities=True):
  76. """Check docinfo of an element tree for DTD and entity declarations
  77. The check for entity declarations needs lxml 3 or newer. lxml 2.x does
  78. not support dtd.iterentities().
  79. """
  80. docinfo = elementtree.docinfo
  81. if docinfo.doctype:
  82. if forbid_dtd:
  83. raise DTDForbidden(docinfo.doctype,
  84. docinfo.system_url,
  85. docinfo.public_id)
  86. if forbid_entities and not LXML3:
  87. # lxml < 3 has no iterentities()
  88. raise NotSupportedError("Unable to check for entity declarations "
  89. "in lxml 2.x")
  90. if forbid_entities:
  91. for dtd in docinfo.internalDTD, docinfo.externalDTD:
  92. if dtd is None:
  93. continue
  94. for entity in dtd.iterentities():
  95. raise EntitiesForbidden(entity.name, entity.content, None,
  96. None, None, None)
  97. def parse(source, parser=None, base_url=None, forbid_dtd=False,
  98. forbid_entities=True):
  99. if parser is None:
  100. parser = getDefaultParser()
  101. elementtree = _etree.parse(source, parser, base_url=base_url)
  102. check_docinfo(elementtree, forbid_dtd, forbid_entities)
  103. return elementtree
  104. def fromstring(text, parser=None, base_url=None, forbid_dtd=False,
  105. forbid_entities=True):
  106. if parser is None:
  107. parser = getDefaultParser()
  108. rootelement = _etree.fromstring(text, parser, base_url=base_url)
  109. elementtree = rootelement.getroottree()
  110. check_docinfo(elementtree, forbid_dtd, forbid_entities)
  111. return rootelement
  112. XML = fromstring
  113. def iterparse(*args, **kwargs):
  114. raise NotSupportedError("defused lxml.etree.iterparse not available")