Previous challenge Home
The vulnerability is Improper Restriction of XML External Entity Reference
python
# vulnerable code
from lxml import etree

def parse_xml(xml_data):
    parser = etree.XMLParser()
    tree = etree.fromstring(xml_data, parser)
    return etree.tostring(tree)
python # vulnerable code from lxml import etree def parse_xml(xml_data): parser = etree.XMLParser() tree = etree.fromstring(xml_data, parser) return etree.tostring(tree) To fix the vulnerability, disable the resolution of external entities in the XML parser. In the lxml library, this can be achieved by setting the `resolve_entities` parameter to `False`.
python
# solution how to fix the vulnerable code
from lxml import etree

def parse_xml(xml_data):
    parser = etree.XMLParser(resolve_entities=False)
    tree = etree.fromstring(xml_data, parser)
    return etree.tostring(tree)