Live data from Hacker News

Defusedxml – defusing XML bombs and other exploits

github.com

21–22 of 22 posts

Re: Defusedxml – defusing XML bombs and other exploits

#21
post #16

Earlier quoted context omitted.

> Regarding DOCTYPE and DTDs, browsers at best made use of those to switch into or out of "quirks mode", on seeing special hardcoded public identifiers but ignored any declarations. Not when processing XML mime types. In modern browsers that mostly means SVG files, but i think XHTML is still possible. (Modern) HTML is neither SGML nor XML, so it doesn't follow the rules of either.

"Modern" WHATWG HTML is still following SGML rules to the letter in its dealings with tag inference and attribute shortforms ([1]). Which isn't surprising when it's supposed to hold up backward compat. To say that "HTML is not SGML" is a mere political statement so as not be held accountable to SGML specs. But (the loose group of Chrome devs and other individuals financed by Google to write unversioned HTML spec pros…

> "Modern" WHATWG HTML is still following SGML rules to the letter...To say that "HTML is not SGML" is a mere political statement so as not be held accountable to SGML specs.

That is self-contradictory and makes no sense. If its following sgml to the letter than there is nobody to be held accountable for violating the sgml spec and hence nobody to hide behind "political statements".

You can't have this both ways.

> Regarding SVG and XHTML, note browsers basically ignore most DTD declarations in those.

They listen to dtd's for entity references and default attribute values. I'd hardly call that ignoring.

Re: Defusedxml – defusing XML bombs and other exploits

#22
post #4

Earlier quoted context omitted.

Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?

From the author themselves, 6 years ago: > defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion. https://github.com/tiran/defusedxml/issues/25#issuecomment-4...

OK, so the defusedxml.lxml submodule is deprecated and one should use the other APIs from defusedxml instead. That does not mean that defusedxml in it's entirety would be useless.
Post reply on HN