<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>A completely secure alternative isn't available in the Python standard library. Here's a table of various XML libraries and the vulnerabilities they may be affected by [1]. This is partially reflected in Python's official documentation as well (version
2.7.12) [2].</div>
<div><br>
</div>
<div>There are currently 132 references to "xml.etree.ElementTree" alone in OpenStack projects [3]. Granted, most of these examples aren't likely to have serious security ramifications, but the potential is there (see the Glance OVF bug mentioned by Travis
for a relatively mild example). XML is definitely on the decline, but for the remaining stragglers, having a secure, stable solution might be a good idea. The codebase of defusedxml is fairly small, basically just replacing a few vulnerable functions in popular
XML libraries with more secure versions. Might it be something OpenStack could maintain a fork of? </div>
<div><br>
</div>
<div>Since the bandit documentation suggests using defusedxml as a mitigation for these issues, we should at least figure out an alternative suggestion for bandit to provide if defusedxml doesn't meet OpenStack's needs.</div>
<div><br>
</div>
<div>[1]: https://pypi.python.org/pypi/defusedxml#python-xml-libraries</div>
<div>[2]: https://docs.python.org/2/library/xml.html#xml-vulnerabilities</div>
<div>[3]: https://github.com/search?utf8=%E2%9C%93&q=org%3Aopenstack+%22xml.etree.elementtree%22+language%3Apython&type=Code&ref=searchresults</div>
<div><br>
</div>
<div>Charles Neill</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Travis McPeak <<a href="mailto:travis.mcpeak@gmail.com">travis.mcpeak@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, September 27, 2016 at 13:45<br>
<span style="font-weight:bold">To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [openstack-dev] [Security] XML Attacks and DefusedXML on Global Requirements<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">There is a private security bug about it right now too. No, not all XML libraries are immune now.</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Sep 27, 2016 at 11:36 AM, Dave Walker <span dir="ltr">
<<a href="mailto:email@daviey.com" target="_blank">email@daviey.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote"><span class="">On 27 September 2016 at 19:19, Sean Dague
<span dir="ltr"><<a href="mailto:sean@dague.net" target="_blank">sean@dague.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span>On 09/27/2016 01:24 PM, Travis McPeak wrote:<br>
> There are several attacks (<a href="https://pypi.python.org/pypi/defusedxml#id3" rel="noreferrer" target="_blank">https://pypi.python.org/pypi/<wbr>defusedxml#id3</a>)<br>
> that can be performed when XML is parsed from untrusted input.<br>
> DefusedXML offers safe alternatives to XML parsing libraries but is not<br>
> currently part of global requirements.<br>
><br>
> I propose adding DefusedXML to global requirements so that projects have<br>
> an option for safe XML parsing. Does anybody have any thoughts or<br>
> objections?<br>
<br>
</span>Out of curiosity, are there specific areas of concern in existing<br>
projects here? Most projects have dropped XML API support.<br>
<span><font color="#888888"><br>
</font></span></blockquote>
<div><br>
</div>
</span>
<div>Outbound XML datasources which are parsed still used with at least nova vmware support and multiple cinder drivers.</div>
<div><br>
</div>
<div>openstack/ec2-api is still providing an xml api service?<br>
</div>
<div><br>
</div>
<div>--</div>
<div>Kind Regards,</div>
<div>Dave Walker</div>
</div>
</div>
</div>
<br>
______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">
OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature" data-smartmail="gmail_signature">-Travis</div>
</div>
</div>
</div>
</span>
</body>
</html>