[3.14] gh-127502: Remove XML vulnerability table (GH-135294) (#136359)

gh-127502: Remove XML vulnerability table (GH-135294)

* Remove the table
* Replace warnings with notes

Latest releases of Python 3.9-3.15 include expat 2.7.1 which is not vulnerable.

expat 2.6.0 was released in February 2024.
(cherry picked from commit cb99d992774b67761441e122965ed056bac09241)

Co-authored-by: Victor Stinner <vstinner@python.org>

diff --git a/Doc/library/pyexpat.rst b/Doc/library/pyexpat.rst
index 2d57cff10a9278a31b9fdec2cc7a0173c6d9365a..5506ac828e5abe7aa27f04492db3a79522810ff5 100644 (file)
--- a/Doc/library/pyexpat.rst
+++ b/Doc/library/pyexpat.rst
@@ -16,11 +16,10 @@
    references to these attributes should be marked using the :member: role.
 
 
-.. warning::
+.. note::
 
-   The :mod:`pyexpat` module is not secure against maliciously
-   constructed data.  If you need to parse untrusted or unauthenticated data see
-   :ref:`xml-vulnerabilities`.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 
 .. index:: single: Expat

diff --git a/Doc/library/security_warnings.rst b/Doc/library/security_warnings.rst
index a573c98f73eb0a007d47a25b0cf9399e4f896dc7..70c359cc1c0fc34ad032d664228221996bd680b5 100644 (file)
--- a/Doc/library/security_warnings.rst
+++ b/Doc/library/security_warnings.rst
@@ -28,7 +28,7 @@ The following modules have specific security considerations:
   <subprocess-security>`
 * :mod:`tempfile`: :ref:`mktemp is deprecated due to vulnerability to race
   conditions <tempfile-mktemp-deprecated>`
-* :mod:`xml`: :ref:`XML vulnerabilities <xml-vulnerabilities>`
+* :mod:`xml`: :ref:`XML security <xml-security>`
 * :mod:`zipfile`: :ref:`maliciously prepared .zip files can cause disk volume
   exhaustion <zipfile-resources-limitations>`
 

diff --git a/Doc/library/xml.dom.minidom.rst b/Doc/library/xml.dom.minidom.rst
index 00a18751207e7a260051ba0a67dd81b5973c8710..9ffedf7366a7b8c8a68f03bcd5a17609126f4b26 100644 (file)
--- a/Doc/library/xml.dom.minidom.rst
+++ b/Doc/library/xml.dom.minidom.rst
@@ -19,11 +19,10 @@ not already proficient with the DOM should consider using the
 :mod:`xml.etree.ElementTree` module for their XML processing instead.
 
 
-.. warning::
+.. note::
 
-   The :mod:`xml.dom.minidom` module is not secure against
-   maliciously constructed data.  If you need to parse untrusted or
-   unauthenticated data see :ref:`xml-vulnerabilities`.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 
 DOM applications typically start by parsing some XML into a DOM.  With

diff --git a/Doc/library/xml.dom.pulldom.rst b/Doc/library/xml.dom.pulldom.rst
index fd96765cbe3c96dee2bd88b56f3b5993de03bc80..8bceeecd46393e3a6a3228f19c5998b97175830c 100644 (file)
--- a/Doc/library/xml.dom.pulldom.rst
+++ b/Doc/library/xml.dom.pulldom.rst
@@ -19,11 +19,10 @@ responsible for explicitly pulling events from the stream, looping over those
 events until either processing is finished or an error condition occurs.
 
 
-.. warning::
+.. note::
 
-   The :mod:`xml.dom.pulldom` module is not secure against
-   maliciously constructed data.  If you need to parse untrusted or
-   unauthenticated data see :ref:`xml-vulnerabilities`.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 .. versionchanged:: 3.7.1
 

diff --git a/Doc/library/xml.etree.elementtree.rst b/Doc/library/xml.etree.elementtree.rst
index 1daf6628013bf0635a74ffa78f31ebbac200bc0c..00075ac2a23e6bef89c32a84524dec0c8b6b17ec 100644 (file)
--- a/Doc/library/xml.etree.elementtree.rst
+++ b/Doc/library/xml.etree.elementtree.rst
@@ -20,11 +20,10 @@ for parsing and creating XML data.
    The :mod:`!xml.etree.cElementTree` module is deprecated.
 
 
-.. warning::
+.. note::
 
-   The :mod:`xml.etree.ElementTree` module is not secure against
-   maliciously constructed data.  If you need to parse untrusted or
-   unauthenticated data see :ref:`xml-vulnerabilities`.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 Tutorial
 --------

diff --git a/Doc/library/xml.rst b/Doc/library/xml.rst
index d495995398959dfa213ba66d26f2a2883a66b834..28465219a1ac1802bf740921cbc52f5bd3bdf79d 100644 (file)
--- a/Doc/library/xml.rst
+++ b/Doc/library/xml.rst
@@ -15,12 +15,10 @@ XML Processing Modules
 
 Python's interfaces for processing XML are grouped in the ``xml`` package.
 
-.. warning::
+.. note::
 
-   The XML modules are not secure against erroneous or maliciously
-   constructed data.  If you need to parse untrusted or
-   unauthenticated data see the :ref:`xml-vulnerabilities` and
-   :ref:`defusedxml-package` sections.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 It is important to note that modules in the :mod:`xml` package require that
 there be at least one SAX-compliant XML parser available. The Expat parser is
@@ -47,46 +45,22 @@ The XML handling submodules are:
 * :mod:`xml.parsers.expat`: the Expat parser binding
 
 
+.. _xml-security:
 .. _xml-vulnerabilities:
 
-XML vulnerabilities
--------------------
+XML security
+------------
 
-The XML processing modules are not secure against maliciously constructed data.
 An attacker can abuse XML features to carry out denial of service attacks,
 access local files, generate network connections to other machines, or
 circumvent firewalls.
 
-The following table gives an overview of the known attacks and whether
-the various modules are vulnerable to them.
-
-=========================  ==================  ==================  ==================  ==================  ==================
-kind                       sax                 etree               minidom             pulldom             xmlrpc
-=========================  ==================  ==================  ==================  ==================  ==================
-billion laughs             **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)
-quadratic blowup           **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)  **Vulnerable** (1)
-external entity expansion  Safe (5)            Safe (2)            Safe (3)            Safe (5)            Safe (4)
-`DTD`_ retrieval           Safe (5)            Safe                Safe                Safe (5)            Safe
-decompression bomb         Safe                Safe                Safe                Safe                **Vulnerable**
-large tokens               **Vulnerable** (6)  **Vulnerable** (6)  **Vulnerable** (6)  **Vulnerable** (6)  **Vulnerable** (6)
-=========================  ==================  ==================  ==================  ==================  ==================
-
-1. Expat 2.4.1 and newer is not vulnerable to the "billion laughs" and
-   "quadratic blowup" vulnerabilities. Items still listed as vulnerable due to
-   potential reliance on system-provided libraries. Check
-   :const:`!pyexpat.EXPAT_VERSION`.
-2. :mod:`xml.etree.ElementTree` doesn't expand external entities and raises a
-   :exc:`~xml.etree.ElementTree.ParseError` when an entity occurs.
-3. :mod:`xml.dom.minidom` doesn't expand external entities and simply returns
-   the unexpanded entity verbatim.
-4. :mod:`xmlrpc.client` doesn't expand external entities and omits them.
-5. Since Python 3.7.1, external general entities are no longer processed by
-   default.
-6. Expat 2.6.0 and newer is not vulnerable to denial of service
-   through quadratic runtime caused by parsing large tokens.
-   Items still listed as vulnerable due to
-   potential reliance on system-provided libraries. Check
-   :const:`!pyexpat.EXPAT_VERSION`.
+Expat versions lower that 2.6.0 may be vulnerable to "billion laughs",
+"quadratic blowup" and "large tokens". Python may be vulnerable if it uses such
+older versions of Expat as a system-provided library.
+Check :const:`!pyexpat.EXPAT_VERSION`.
+
+:mod:`xmlrpc` is **vulnerable** to the "decompression bomb" attack.
 
 
 billion laughs / exponential entity expansion
@@ -103,16 +77,6 @@ quadratic blowup entity expansion
   efficient as the exponential case but it avoids triggering parser countermeasures
   that forbid deeply nested entities.
 
-external entity expansion
-  Entity declarations can contain more than just text for replacement. They can
-  also point to external resources or local files. The XML
-  parser accesses the resource and embeds the content into the XML document.
-
-`DTD`_ retrieval
-  Some XML libraries like Python's :mod:`xml.dom.pulldom` retrieve document type
-  definitions from remote or local locations. The feature has similar
-  implications as the external entity expansion issue.
-
 decompression bomb
   Decompression bombs (aka `ZIP bomb`_) apply to all XML libraries
   that can parse compressed XML streams such as gzipped HTTP streams or
@@ -126,21 +90,5 @@ large tokens
   be used to cause denial of service in the application parsing XML.
   The issue is known as :cve:`2023-52425`.
 
-The documentation for :pypi:`defusedxml` on PyPI has further information about
-all known attack vectors with examples and references.
-
-.. _defusedxml-package:
-
-The :mod:`!defusedxml` Package
-------------------------------
-
-:pypi:`defusedxml` is a pure Python package with modified subclasses of all stdlib
-XML parsers that prevent any potentially malicious operation. Use of this
-package is recommended for any server code that parses untrusted XML data. The
-package also ships with example exploits and extended documentation on more
-XML exploits such as XPath injection.
-
-
 .. _Billion Laughs: https://en.wikipedia.org/wiki/Billion_laughs
 .. _ZIP bomb: https://en.wikipedia.org/wiki/Zip_bomb
-.. _DTD: https://en.wikipedia.org/wiki/Document_type_definition

diff --git a/Doc/library/xml.sax.rst b/Doc/library/xml.sax.rst
index c60e9e505f75443533226bbf172311f3aea6977a..5fa92645a440ce3bfafe5495bc8312dc3cba0316 100644 (file)
--- a/Doc/library/xml.sax.rst
+++ b/Doc/library/xml.sax.rst
@@ -18,11 +18,10 @@ SAX exceptions and the convenience functions which will be most used by users of
 the SAX API.
 
 
-.. warning::
+.. note::
 
-   The :mod:`xml.sax` module is not secure against maliciously
-   constructed data.  If you need to parse untrusted or unauthenticated data see
-   :ref:`xml-vulnerabilities`.
+   If you need to parse untrusted or unauthenticated data, see
+   :ref:`xml-security`.
 
 .. versionchanged:: 3.7.1
 

diff --git a/Doc/library/xmlrpc.client.rst b/Doc/library/xmlrpc.client.rst
index 654154cb43d6e56f59878d6c6ce72ad853fbc196..547cb50be78a782620f844f62a71ff7567de8acd 100644 (file)
--- a/Doc/library/xmlrpc.client.rst
+++ b/Doc/library/xmlrpc.client.rst
@@ -24,8 +24,8 @@ between conformable Python objects and XML on the wire.
 .. warning::
 
    The :mod:`xmlrpc.client` module is not secure against maliciously
-   constructed data.  If you need to parse untrusted or unauthenticated data see
-   :ref:`xml-vulnerabilities`.
+   constructed data.  If you need to parse untrusted or unauthenticated data,
+   see :ref:`xml-security`.
 
 .. versionchanged:: 3.5
 

diff --git a/Doc/library/xmlrpc.server.rst b/Doc/library/xmlrpc.server.rst
index 06169c7eca8b0cce83fbf049ce3b9631b151353b..2a8f6f8d5fc0de5810c61dafcf7c38fe341ba4aa 100644 (file)
--- a/Doc/library/xmlrpc.server.rst
+++ b/Doc/library/xmlrpc.server.rst
@@ -20,8 +20,8 @@ servers written in Python.  Servers can either be free standing, using
 .. warning::
 
    The :mod:`xmlrpc.server` module is not secure against maliciously
-   constructed data.  If you need to parse untrusted or unauthenticated data see
-   :ref:`xml-vulnerabilities`.
+   constructed data.  If you need to parse untrusted or unauthenticated data,
+   see :ref:`xml-security`.
 
 .. include:: ../includes/wasm-notavail.rst