Function _project_xml_is_safe

graphify/extract.py:13775–13790

Reject XML that declares DTDs or entities. Stdlib ``xml.etree.ElementTree`` does not cap entity expansion, so a crafted project file could trigger a billion-laughs style DoS. External entity resolution is already disabled by pyexpat defaults, but rejecting ``<!DOCTYPE`` / ``<!ENTITY

(src: bytes)

def _project_xml_is_safe(src: bytes) -> bool:
    """Reject XML that declares DTDs or entities.

    Stdlib ``xml.etree.ElementTree`` does not cap entity expansion, so a
    crafted project file could trigger a billion-laughs style DoS. External
    entity resolution is already disabled by pyexpat defaults, but rejecting
    ``<!DOCTYPE`` / ``<!ENTITY`` outright is defense in depth.

    Legitimate MSBuild and Lazarus package files never contain a DOCTYPE
    or ENTITY declaration, so this is a zero-false-positive screen.
    """
    # Only the prolog can hold a DTD/internal subset, but be conservative
    # and scan the full byte range -- these formats use ASCII tags so a
    # case-insensitive substring match is sufficient.
    lowered = src.lower()
    return b"<!doctype" not in lowered and b"<!entity" not in lowered


def extract_lazarus_package(path: Path) -> dict: