commit 394e55a9279d17240ef6fe85d3b4ea3fe7b6dff5
author Christian Heimes <christian@python.org> Mon Sep 24 14:38:37 2018 +0200
committer Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Mon Sep 24 05:38:37 2018 -0700
tree 2145116812df54659a7dd66f7b13d718472db531
parent ddc163df25191af5bf8000091dbf8f6500b1d7c9

[3.7] bpo-17239: Disable external entities in SAX parser (GH-9217) (GH-9511)



The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45)

Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue17239

Doc/library/xml.dom.pulldom.rst

diff --git a/Doc/library/xml.dom.pulldom.rst b/Doc/library/xml.dom.pulldom.rst
index 5c0f469..b4974f9 100644
--- a/Doc/library/xml.dom.pulldom.rst
+++ b/Doc/library/xml.dom.pulldom.rst
@@ -25,6 +25,20 @@
    maliciously constructed data.  If you need to parse untrusted or
    unauthenticated data see :ref:`xml-vulnerabilities`.
 
+.. versionchanged:: 3.7.1
+
+   The SAX parser no longer processes general external entities by default to
+   increase security by default. To enable processing of external entities,
+   pass a custom parser instance in::
+
+      from xml.dom.pulldom import parse
+      from xml.sax import make_parser
+      from xml.sax.handler import feature_external_ges
+
+      parser = make_parser()
+      parser.setFeature(feature_external_ges, True)
+      parse(filename, parser=parser)
+
 
 Example::