From 43217fd698135b4795d191f8a935f3ba0b869c54 Mon Sep 17 00:00:00 2001 From: Claudio Salazar Date: Tue, 1 Apr 2014 23:54:04 +0800 Subject: [PATCH] Fixed XXE flaw in sitemap reader --- scrapy/utils/sitemap.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scrapy/utils/sitemap.py b/scrapy/utils/sitemap.py index 24a540531..bbf37bc28 100644 --- a/scrapy/utils/sitemap.py +++ b/scrapy/utils/sitemap.py @@ -12,7 +12,7 @@ class Sitemap(object): (type=sitemapindex) files""" def __init__(self, xmltext): - xmlp = lxml.etree.XMLParser(recover=True, remove_comments=True) + xmlp = lxml.etree.XMLParser(recover=True, remove_comments=True, resolve_entities=False) self._root = lxml.etree.fromstring(xmltext, parser=xmlp) rt = self._root.tag self.type = self._root.tag.split('}', 1)[1] if '}' in rt else rt