{"action":"created","issue":{"url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/68","repository_url":"https://api.github.com/repos/rackerlabs/django-DefectDojo","labels_url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/68/labels{/name}","comments_url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/68/comments","events_url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/68/events","html_url":"https://github.com/rackerlabs/django-DefectDojo/issues/68","id":139940375,"number":68,"title":"defusedxml is a more secure alternative to xml.etree","user":{"login":"MicksMix","id":3154062,"avatar_url":"https://avatars.githubusercontent.com/u/3154062?v=3","gravatar_id":"","url":"https://api.github.com/users/MicksMix","html_url":"https://github.com/MicksMix","followers_url":"https://api.github.com/users/MicksMix/followers","following_url":"https://api.github.com/users/MicksMix/following{/other_user}","gists_url":"https://api.github.com/users/MicksMix/gists{/gist_id}","starred_url":"https://api.github.com/users/MicksMix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MicksMix/subscriptions","organizations_url":"https://api.github.com/users/MicksMix/orgs","repos_url":"https://api.github.com/users/MicksMix/repos","events_url":"https://api.github.com/users/MicksMix/events{/privacy}","received_events_url":"https://api.github.com/users/MicksMix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/labels/triage","name":"triage","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-10T16:26:06Z","updated_at":"2016-03-18T17:47:05Z","closed_at":null,"body":"xml.etree is vulnerable (according to defusedxml documentation) the [following XML attacks](https://pypi.python.org/pypi/defusedxml#python-xml-libraries):\r\n\r\n - [billion Laughs](https://pypi.python.org/pypi/defusedxml#billion-laughs-exponential-entity-expansion)\r\n - [quadratic blowup](https://pypi.python.org/pypi/defusedxml#quadratic-blowup-entity-expansion)\r\n - [XML Inclusion](https://pypi.python.org/pypi/defusedxml#xinclude) (a feature that can present security holes)\r\n\r\nFortunately, the Python community has [responded with defusedxml](https://docs.python.org/2/library/xml.html#defused-packages). It is a near drop-in replacement for xml.etree.\r\n\r\nI found xml.etree used in `parser.py` under each subfolder here:\r\n[dojo/tools](https://github.com/rackerlabs/django-DefectDojo/tree/master/dojo/tools)\r\n\r\nYou should replace `xml.etree` with `defusedxml`."},"comment":{"url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/comments/198467920","html_url":"https://github.com/rackerlabs/django-DefectDojo/issues/68#issuecomment-198467920","issue_url":"https://api.github.com/repos/rackerlabs/django-DefectDojo/issues/68","id":198467920,"user":{"login":"devGregA","id":4741312,"avatar_url":"https://avatars.githubusercontent.com/u/4741312?v=3","gravatar_id":"","url":"https://api.github.com/users/devGregA","html_url":"https://github.com/devGregA","followers_url":"https://api.github.com/users/devGregA/followers","following_url":"https://api.github.com/users/devGregA/following{/other_user}","gists_url":"https://api.github.com/users/devGregA/gists{/gist_id}","starred_url":"https://api.github.com/users/devGregA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devGregA/subscriptions","organizations_url":"https://api.github.com/users/devGregA/orgs","repos_url":"https://api.github.com/users/devGregA/repos","events_url":"https://api.github.com/users/devGregA/events{/privacy}","received_events_url":"https://api.github.com/users/devGregA/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T17:47:05Z","updated_at":"2016-03-18T17:47:05Z","body":"@grendel513 @cneill I agree with @MicksMix finding, xml.etree seems to be reported as vulnerable to XEE. I'll submit a PR shortly"}}