Fixed XXE flaw in sitemap reader

43217fd6 · Claudio Salazar · ade7662f · 43217fd6
隐藏空白更改
内联并排

Showing with 1 addition and 1 deletion

scrapy/utils/sitemap.py scrapy/utils/sitemap.py +1 -1

未找到文件。
--- a/scrapy/utils/sitemap.py
+++ b/scrapy/utils/sitemap.py
@@ -12,7 +12,7 @@ class Sitemap(object):
    (type=sitemapindex) files"""

    def __init__(self, xmltext):
-        xmlp = lxml.etree.XMLParser(recover=True, remove_comments=True)
+        xmlp = lxml.etree.XMLParser(recover=True, remove_comments=True, resolve_entities=False)
        self._root = lxml.etree.fromstring(xmltext, parser=xmlp)
        rt = self._root.tag
        self.type = self._root.tag.split('}', 1)[1] if '}' in rt else rt