You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

110 lines
3.9 KiB

4 years ago
  1. # defusedxml
  2. #
  3. # Copyright (c) 2013 by Christian Heimes <christian@python.org>
  4. # Licensed to PSF under a Contributor Agreement.
  5. # See http://www.python.org/psf/license for licensing details.
  6. """Defused xml.dom.expatbuilder
  7. """
  8. from __future__ import print_function, absolute_import
  9. from xml.dom.expatbuilder import ExpatBuilder as _ExpatBuilder
  10. from xml.dom.expatbuilder import Namespaces as _Namespaces
  11. from .common import (DTDForbidden, EntitiesForbidden,
  12. ExternalReferenceForbidden)
  13. __origin__ = "xml.dom.expatbuilder"
  14. class DefusedExpatBuilder(_ExpatBuilder):
  15. """Defused document builder"""
  16. def __init__(self, options=None, forbid_dtd=False, forbid_entities=True,
  17. forbid_external=True):
  18. _ExpatBuilder.__init__(self, options)
  19. self.forbid_dtd = forbid_dtd
  20. self.forbid_entities = forbid_entities
  21. self.forbid_external = forbid_external
  22. def defused_start_doctype_decl(self, name, sysid, pubid,
  23. has_internal_subset):
  24. raise DTDForbidden(name, sysid, pubid)
  25. def defused_entity_decl(self, name, is_parameter_entity, value, base,
  26. sysid, pubid, notation_name):
  27. raise EntitiesForbidden(name, value, base, sysid, pubid, notation_name)
  28. def defused_unparsed_entity_decl(self, name, base, sysid, pubid,
  29. notation_name):
  30. # expat 1.2
  31. raise EntitiesForbidden(name, None, base, sysid, pubid, notation_name)
  32. def defused_external_entity_ref_handler(self, context, base, sysid,
  33. pubid):
  34. raise ExternalReferenceForbidden(context, base, sysid, pubid)
  35. def install(self, parser):
  36. _ExpatBuilder.install(self, parser)
  37. if self.forbid_dtd:
  38. parser.StartDoctypeDeclHandler = self.defused_start_doctype_decl
  39. if self.forbid_entities:
  40. # if self._options.entities:
  41. parser.EntityDeclHandler = self.defused_entity_decl
  42. parser.UnparsedEntityDeclHandler = self.defused_unparsed_entity_decl
  43. if self.forbid_external:
  44. parser.ExternalEntityRefHandler = self.defused_external_entity_ref_handler
  45. class DefusedExpatBuilderNS(_Namespaces, DefusedExpatBuilder):
  46. """Defused document builder that supports namespaces."""
  47. def install(self, parser):
  48. DefusedExpatBuilder.install(self, parser)
  49. if self._options.namespace_declarations:
  50. parser.StartNamespaceDeclHandler = (
  51. self.start_namespace_decl_handler)
  52. def reset(self):
  53. DefusedExpatBuilder.reset(self)
  54. self._initNamespaces()
  55. def parse(file, namespaces=True, forbid_dtd=False, forbid_entities=True,
  56. forbid_external=True):
  57. """Parse a document, returning the resulting Document node.
  58. 'file' may be either a file name or an open file object.
  59. """
  60. if namespaces:
  61. build_builder = DefusedExpatBuilderNS
  62. else:
  63. build_builder = DefusedExpatBuilder
  64. builder = build_builder(forbid_dtd=forbid_dtd,
  65. forbid_entities=forbid_entities,
  66. forbid_external=forbid_external)
  67. if isinstance(file, str):
  68. fp = open(file, 'rb')
  69. try:
  70. result = builder.parseFile(fp)
  71. finally:
  72. fp.close()
  73. else:
  74. result = builder.parseFile(file)
  75. return result
  76. def parseString(string, namespaces=True, forbid_dtd=False,
  77. forbid_entities=True, forbid_external=True):
  78. """Parse a document from a string, returning the resulting
  79. Document node.
  80. """
  81. if namespaces:
  82. build_builder = DefusedExpatBuilderNS
  83. else:
  84. build_builder = DefusedExpatBuilder
  85. builder = build_builder(forbid_dtd=forbid_dtd,
  86. forbid_entities=forbid_entities,
  87. forbid_external=forbid_external)
  88. return builder.parseString(string)