Attempt to parse the XML using defused XML and the mode options to turn protections on/off When an exception is raised for supported XML problems a detection is yielded back to the analyzer
(location: ScanLocation, **mode)
| 32 | |
| 33 | |
| 34 | def scan(location: ScanLocation, **mode) -> Generator[Detection, None, None]: |
| 35 | """ |
| 36 | Attempt to parse the XML using defused XML and the mode options to turn protections on/off |
| 37 | When an exception is raised for supported XML problems a detection is yielded back to the analyzer |
| 38 | """ |
| 39 | try: |
| 40 | cElementTree.parse(location.str_location, **mode) |
| 41 | except EntitiesForbidden: |
| 42 | yield Detection( |
| 43 | detection_type = "MalformedXML", |
| 44 | message = "Malformed or malicious XML", |
| 45 | score = get_score_or_default("malformed-xml-entities", 100), |
| 46 | extra = { |
| 47 | "type": "entities" |
| 48 | }, |
| 49 | location=location.location, |
| 50 | signature = f"malformed_xml#entities#{str(location)}", |
| 51 | tags = {"malformed_xml", "xml_entities"} |
| 52 | ) |
| 53 | except DTDForbidden: |
| 54 | yield Detection( |
| 55 | detection_type = "MalformedXML", |
| 56 | message = "Malformed or malicious XML", |
| 57 | score = get_score_or_default("malformed-xml-dtd", 20), |
| 58 | extra = { |
| 59 | "type": "dtd" |
| 60 | }, |
| 61 | location=location.location, |
| 62 | signature = f"malformed_xml#dtd#{str(location)}", |
| 63 | tags = {"malformed_xml", "xml_dtd"} |
| 64 | ) |
| 65 | except ExternalReferenceForbidden: |
| 66 | yield Detection( |
| 67 | detection_type = "MalformedXML", |
| 68 | message = "Malformed or malicious XML", |
| 69 | score = get_score_or_default("malformed-xml-external-reference", 100), |
| 70 | extra = { |
| 71 | "type": "external_reference" |
| 72 | }, |
| 73 | location=location.location, |
| 74 | signature = f"malformed_xml#external_reference#{str(location)}", |
| 75 | tags = {"malformed_xml", "xml_external_reference"} |
| 76 | ) |
| 77 | except NotSupportedError: |
| 78 | pass |
| 79 | except ParseError: |
| 80 | pass |
| 81 | except Exception: |
| 82 | pass |
| 83 | |
| 84 | |
| 85 | @Analyzer.ID("xml") |
no test coverage detected