{"action":"closed","issue":{"url":"https://api.github.com/repos/quandyfactory/dicttoxml/issues/41","repository_url":"https://api.github.com/repos/quandyfactory/dicttoxml","labels_url":"https://api.github.com/repos/quandyfactory/dicttoxml/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/quandyfactory/dicttoxml/issues/41/comments","events_url":"https://api.github.com/repos/quandyfactory/dicttoxml/issues/41/events","html_url":"https://github.com/quandyfactory/dicttoxml/issues/41","id":97237312,"number":41,"title":"Library is susceptible to XML Injection","user":{"login":"thomaskonrad","id":2149539,"avatar_url":"https://avatars.githubusercontent.com/u/2149539?v=3","gravatar_id":"","url":"https://api.github.com/users/thomaskonrad","html_url":"https://github.com/thomaskonrad","followers_url":"https://api.github.com/users/thomaskonrad/followers","following_url":"https://api.github.com/users/thomaskonrad/following{/other_user}","gists_url":"https://api.github.com/users/thomaskonrad/gists{/gist_id}","starred_url":"https://api.github.com/users/thomaskonrad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thomaskonrad/subscriptions","organizations_url":"https://api.github.com/users/thomaskonrad/orgs","repos_url":"https://api.github.com/users/thomaskonrad/repos","events_url":"https://api.github.com/users/thomaskonrad/events{/privacy}","received_events_url":"https://api.github.com/users/thomaskonrad/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2015-07-25T16:33:59Z","updated_at":"2016-07-07T02:25:54Z","closed_at":"2016-07-07T02:25:53Z","body":"Hi,\r\n\r\nthe library fails to XML-encode the dict input and is therefore susceptible to XML injection. See this example:\r\n\r\n```\r\n>>> from dicttoxml import dicttoxml\r\n>>> dict = {'foo': 'bar', '\" injected-attribute=\"value\" <!--': 'bar'}\r\n>>> print(dicttoxml(dict, attr_type=False))\r\nb'<?xml version=\"1.0\" encoding=\"UTF-8\" ?><root><key name=\"\" injected-attribute=\"value\" <!--\">bar</key><foo>bar</foo></root>'\r\n```\r\n\r\nSo one can change the XML structure. Suppose the application using this library and the input comes (at least partially) from the user, then this may lead to severe security vulnerabilities. See also [here](https://www.owasp.org/index.php/Testing_for_XML_Injection_(OTG-INPVAL-008)).\r\n\r\nProposed solution: XML-encode all data that is placed into the XML document.\r\n\r\nCheers\r\nThomas"}}
{"actor":{"display_login":"quandyfactory"}}