commit 394e55a9279d17240ef6fe85d3b4ea3fe7b6dff5
author Christian Heimes <christian@python.org> Mon Sep 24 14:38:37 2018 +0200
committer Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Mon Sep 24 05:38:37 2018 -0700
tree 2145116812df54659a7dd66f7b13d718472db531
parent ddc163df25191af5bf8000091dbf8f6500b1d7c9

[3.7] bpo-17239: Disable external entities in SAX parser (GH-9217) (GH-9511)



The SAX parser no longer processes general external entities by default
to increase security. Before, the parser created network connections
to fetch remote files or loaded local files from the file system for DTD
and entities.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue17239.
(cherry picked from commit 17b1d5d4e36aa57a9b25a0e694affbd1ee637e45)

Co-authored-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue17239

Lib/xml/sax/expatreader.py

diff --git a/Lib/xml/sax/expatreader.py b/Lib/xml/sax/expatreader.py
index 421358f..5066ffc 100644
--- a/Lib/xml/sax/expatreader.py
+++ b/Lib/xml/sax/expatreader.py
@@ -95,7 +95,7 @@
         self._lex_handler_prop = None
         self._parsing = 0
         self._entity_stack = []
-        self._external_ges = 1
+        self._external_ges = 0
         self._interning = None
 
     # XMLReader methods