openedx.core.lib.safe_lxml package#

Submodules#

openedx.core.lib.safe_lxml.conftest module#

Code run by pytest before running any tests in the safe_lxml directory.

openedx.core.lib.safe_lxml.etree module#

Safer version of lxml.etree.

It overrides some unsafe functions from lxml.etree with safer versions from defusedxml. It also includes a safer XMLParser.

For processing xml always prefer this over using lxml.etree directly.

isort:skip_file

class openedx.core.lib.safe_lxml.etree.XMLParser(*args, **kwargs)#

Bases: XMLParser

A safer version of XMLParser which by default disables entity resolution.

openedx.core.lib.safe_lxml.xmlparser module#

lxml.etree protection

class openedx.core.lib.safe_lxml.xmlparser.GlobalParserTLS#

Bases: _local

Thread local context for custom parser instances

createDefaultParser()#
element_class#

alias of RestrictedElement

getDefaultParser()#
parser_config = {'resolve_entities': False}#
setDefaultParser(parser)#
class openedx.core.lib.safe_lxml.xmlparser.RestrictedElement#

Bases: ElementBase

A restricted Element class that filters out instances of some classes

blacklist = (<class 'lxml.etree._Entity'>, <class 'lxml.etree._ProcessingInstruction'>, <class 'lxml.etree._Comment'>)#
getchildren(self)#

Returns all direct children. The elements are returned in document order.

Deprecated:

Note that this method has been deprecated as of ElementTree 1.3 and lxml 2.0. New code should use list(element) or simply iterate over elements.

getiterator(self, tag=None, *tags)#

Returns a sequence or iterator of all elements in the subtree in document order (depth first pre-order), starting with this element.

Can be restricted to find only elements with specific tags, see iter.

Deprecated:

Note that this method is deprecated as of ElementTree 1.3 and lxml 2.0. It returns an iterator in lxml, which diverges from the original ElementTree behaviour. If you want an efficient iterator, use the element.iter() method instead. You should only use this method in new code if you require backwards compatibility with older versions of lxml or ElementTree.

iter(self, tag=None, *tags)#

Iterate over all elements in the subtree in document order (depth first pre-order), starting with this element.

Can be restricted to find only elements with specific tags: pass "{ns}localname" as tag. Either or both of ns and localname can be * for a wildcard; ns can be empty for no namespace. "localname" is equivalent to "{}localname" (i.e. no namespace) but "*" is "{*}*" (any or no namespace), not "{}*".

You can also pass the Element, Comment, ProcessingInstruction and Entity factory functions to look only for the specific element type.

Passing multiple tags (or a sequence of tags) instead of a single tag will let the iterator return all elements matching any of these tags, in document order.

iterchildren(self, tag=None, *tags, reversed=False)#

Iterate over the children of this element.

As opposed to using normal iteration on this element, the returned elements can be reversed with the ‘reversed’ keyword and restricted to find only elements with specific tags, see iter.

iterdescendants(self, tag=None, *tags)#

Iterate over the descendants of this element in document order.

As opposed to el.iter(), this iterator does not yield the element itself. The returned elements can be restricted to find only elements with specific tags, see iter.

itersiblings(self, tag=None, *tags, preceding=False)#

Iterate over the following or preceding siblings of this element.

The direction is determined by the ‘preceding’ keyword which defaults to False, i.e. forward iteration over the following siblings. When True, the iterator yields the preceding siblings in reverse document order, i.e. starting right before the current element and going backwards.

Can be restricted to find only elements with specific tags, see iter.

openedx.core.lib.safe_lxml.xmlparser.XML(text, parser=None, base_url=None, forbid_dtd=False, forbid_entities=True)#
openedx.core.lib.safe_lxml.xmlparser.check_docinfo(elementtree, forbid_dtd=False, forbid_entities=True)#

Check docinfo of an element tree for DTD and entity declarations The check for entity declarations needs lxml 3 or newer. lxml 2.x does not support dtd.iterentities().

openedx.core.lib.safe_lxml.xmlparser.fromstring(text, parser=None, base_url=None, forbid_dtd=False, forbid_entities=True)#
openedx.core.lib.safe_lxml.xmlparser.getDefaultParser()#
openedx.core.lib.safe_lxml.xmlparser.iterparse(*args, **kwargs)#
openedx.core.lib.safe_lxml.xmlparser.parse(source, parser=None, base_url=None, forbid_dtd=False, forbid_entities=True)#

Module contents#

Defuse vulnerabilities in XML packages.

openedx.core.lib.safe_lxml.defuse_xml_libs()#

Monkey patch and defuse all stdlib xml packages and lxml.