prevent XXE

RebelMouseTeam · Jun 7, 2017 · e50fbd3 · e50fbd3
1 parent e7e8d79
commit e50fbd3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/speedparser/speedparser.py b/speedparser/speedparser.py
@@ -576,7 +576,7 @@ def __init__(self, content, cleaner=default_cleaner, unix_timestamp=False, encod
         self.unix_timestamp = unix_timestamp
         if self.xmlns and '#' in self.xmlns:
             self.xmlns = self.xmlns.strip('#')
-        parser = etree.XMLParser(recover=True)
+        parser = etree.XMLParser(recover=True, resolve_entities=False)
         tree = etree.fromstring(content, parser=parser)
         if isinstance(tree, etree._ElementTree):
             self.tree = tree