Open Stack

On Tue, Sep 30, 2014 at 09:28:22AM +0930, Christopher Yeoh wrote:
> On Mon, 29 Sep 2014 18:03:20 +0200
> Julien Danjou <julien at danjou.info> wrote:
> > 
> > It seems that Python fixed that issue with 2 modules released on PyPI:
> > 
> >   https://pypi.python.org/pypi/defusedxml
> >   https://pypi.python.org/pypi/defusedexpat
> > 
> > I'm no XML expert, and I've only a shallow understanding of the issue,
> > but I wonder if we should put some efforts to drop xmlutils and our
> > custom XML fixes to used instead these 2 modules.
> 
> Nova XML API support is marked as deprecated in Juno. So hopefully
> we'll be able to just drop XML and associated helper modules within a
> couple of cycles.

Even if Nova doesn't have an XML API, internals of Nova still need to
deal with XML. eg the libvirt driver needs to parse & format XML docs.
At least these docs are coming from a trusted source, not the untrusted
end user, but we'll always have a need for python XML modules of some
kind.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|