Whole file

martinblech/xmltodict

The author described this change as “fix: fail closed when entities disabled”. It counts as a record because the checks below fail on the code as it stood at 3d4d2d3a4 and pass on c986d2d37, with nothing else changed between the two runs.

Projectmartinblech/xmltodict

Fix saved2025-09-16

Sharing licenceMIT · LICENSE

Change size+17 −4

What the code was meant to do, written into the code itself as a save note

fix: fail closed when entities disabled

The change

354	354		parser.CommentHandler = handler.comments
355	355		parser.buffer_text = True
356	356		if disable_entities:
357		-	# Anything not handled ends up here and entities aren't expanded.
358		-	parser.DefaultHandler = lambda x: None
359		-	# Expects an integer return; zero means failure -> expat.ExpatError.
360		-	parser.ExternalEntityRefHandler = lambda *x: 1
	357	+	def _forbid_entities(_args, *_kwargs):
	358	+	raise expat.ExpatError("xmltodict.parse(): entities are disabled")
	359	+
	360	+	def _forbid_entities_default(text):
	361	+	if not text:
	362	+	return
	363	+	stripped = text.lstrip()
	364	+	if stripped.startswith('<!--'):
	365	+	return
	366	+	if stripped.startswith('<!') or stripped.startswith('&'):
	367	+	_forbid_entities()
	368	+
	369	+	# Reject DTD/entity constructs explicitly instead of ignoring them.
	370	+	parser.DefaultHandler = _forbid_entities_default
	371	+	parser.EntityDeclHandler = _forbid_entities
	372	+	parser.StartDoctypeDeclHandler = _forbid_entities
	373	+	parser.ExternalEntityRefHandler = _forbid_entities
361	374		if hasattr(xml_input, 'read'):
362	375		parser.ParseFile(xml_input)
363	376		elif isgenerator(xml_input):

The check that tells the two apart

fail→pass·tests/test_xmltodict.py::test_disable_entities_true_rejects_external_dtd

fail→pass·tests/test_xmltodict.py::test_disable_entities_true_rejects_xmlbomb

Check file tests/test_xmltodict.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.

Origin and history

The fixc986d2d37a93d45fcc059b09063d9d9c45a655ec

The code before it3d4d2d3a4cd0f68d1211dba549010261fa87b969

Broken version dated2025-09-16

Modulexmltodict

Units changedparse

Fingerprint489c3fa51e2bf8c7

Checked2026-08-18 by goldset/0.1

Every field above is generated by our program. None of it is written by hand.

What the code was meant to do, written into the code itself as a save note

The change

The check that tells the two apart

Origin and history

Other bugs found in martinblech/xmltodict