xml.dom.minidom for DOM-style XML parsing. Built on pyexpat which by default does not resolve external entities, but custom resolvers can reintroduce XXE. defusedxml.minidom is the hardened replacement.
.parse().parseString().parse()Sinkxml.dom.minidom.parse(file, parser=None, bufsize=None) -> Document
Parses XML file via minidom. XXE sink on custom parsers that resolve externals.
0.parseString()Sinkxml.dom.minidom.parseString(string, parser=None) -> Document
Parses XML string. Same XXE considerations.
0| FQN | Field | |
|---|---|---|
| xml.dom | fqns[0] | |
| xml.dom.minidom | fqns[1] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyXmlDom