codekingpro/portable-devtools

1# defusedxml2#3# Copyright (c) 2013 by Christian Heimes <christian@python.org>4# Licensed to PSF under a Contributor Agreement.5# See https://www.python.org/psf/license for licensing details.6"""DEPRECATED Example code for lxml.etree protection7 8The code has NO protection against decompression bombs.9"""10from __future__ import print_function, absolute_import11 12import threading13import warnings14 15from lxml import etree as _etree16 17from .common import DTDForbidden, EntitiesForbidden, NotSupportedError18 19LXML3 = _etree.LXML_VERSION[0] >= 320 21__origin__ = "lxml.etree"22 23tostring = _etree.tostring24 25 26warnings.warn(27    "defusedxml.lxml is no longer supported and will be removed in a future release.",28    category=DeprecationWarning,29    stacklevel=2,30)31 32 33class RestrictedElement(_etree.ElementBase):34    """A restricted Element class that filters out instances of some classes"""35 36    __slots__ = ()37    # blacklist = (etree._Entity, etree._ProcessingInstruction, etree._Comment)38    blacklist = _etree._Entity39 40    def _filter(self, iterator):41        blacklist = self.blacklist42        for child in iterator:43            if isinstance(child, blacklist):44                continue45            yield child46 47    def __iter__(self):48        iterator = super(RestrictedElement, self).__iter__()49        return self._filter(iterator)50 51    def iterchildren(self, tag=None, reversed=False):52        iterator = super(RestrictedElement, self).iterchildren(tag=tag, reversed=reversed)53        return self._filter(iterator)54 55    def iter(self, tag=None, *tags):56        iterator = super(RestrictedElement, self).iter(tag=tag, *tags)57        return self._filter(iterator)58 59    def iterdescendants(self, tag=None, *tags):60        iterator = super(RestrictedElement, self).iterdescendants(tag=tag, *tags)61        return self._filter(iterator)62 63    def itersiblings(self, tag=None, preceding=False):64        iterator = super(RestrictedElement, self).itersiblings(tag=tag, preceding=preceding)65        return self._filter(iterator)66 67    def getchildren(self):68        iterator = super(RestrictedElement, self).__iter__()69        return list(self._filter(iterator))70 71    def getiterator(self, tag=None):72        iterator = super(RestrictedElement, self).getiterator(tag)73        return self._filter(iterator)74 75 76class GlobalParserTLS(threading.local):77    """Thread local context for custom parser instances"""78 79    parser_config = {80        "resolve_entities": False,81        # 'remove_comments': True,82        # 'remove_pis': True,83    }84 85    element_class = RestrictedElement86 87    def createDefaultParser(self):88        parser = _etree.XMLParser(**self.parser_config)89        element_class = self.element_class90        if self.element_class is not None:91            lookup = _etree.ElementDefaultClassLookup(element=element_class)92            parser.set_element_class_lookup(lookup)93        return parser94 95    def setDefaultParser(self, parser):96        self._default_parser = parser97 98    def getDefaultParser(self):99        parser = getattr(self, "_default_parser", None)100        if parser is None:101            parser = self.createDefaultParser()102            self.setDefaultParser(parser)103        return parser104 105 106_parser_tls = GlobalParserTLS()107getDefaultParser = _parser_tls.getDefaultParser108 109 110def check_docinfo(elementtree, forbid_dtd=False, forbid_entities=True):111    """Check docinfo of an element tree for DTD and entity declarations112 113    The check for entity declarations needs lxml 3 or newer. lxml 2.x does114    not support dtd.iterentities().115    """116    docinfo = elementtree.docinfo117    if docinfo.doctype:118        if forbid_dtd:119            raise DTDForbidden(docinfo.doctype, docinfo.system_url, docinfo.public_id)120        if forbid_entities and not LXML3:121            # lxml < 3 has no iterentities()122            raise NotSupportedError("Unable to check for entity declarations " "in lxml 2.x")123 124    if forbid_entities:125        for dtd in docinfo.internalDTD, docinfo.externalDTD:126            if dtd is None:127                continue128            for entity in dtd.iterentities():129                raise EntitiesForbidden(entity.name, entity.content, None, None, None, None)130 131 132def parse(source, parser=None, base_url=None, forbid_dtd=False, forbid_entities=True):133    if parser is None:134        parser = getDefaultParser()135    elementtree = _etree.parse(source, parser, base_url=base_url)136    check_docinfo(elementtree, forbid_dtd, forbid_entities)137    return elementtree138 139 140def fromstring(text, parser=None, base_url=None, forbid_dtd=False, forbid_entities=True):141    if parser is None:142        parser = getDefaultParser()143    rootelement = _etree.fromstring(text, parser, base_url=base_url)144    elementtree = rootelement.getroottree()145    check_docinfo(elementtree, forbid_dtd, forbid_entities)146    return rootelement147 148 149XML = fromstring150 151 152def iterparse(*args, **kwargs):153    raise NotSupportedError("defused lxml.etree.iterparse not available")154