xml.sax is the stdlib SAX parser. By default it resolves external entities — XXE sink on untrusted XML. Disable with parser.setFeature(feature_external_ges, False) or use defusedxml.sax.
.parse().parseString().make_parser().parse()Sinkxml.sax.parse(source, handler, error_handler=...) -> None
Parses XML with a SAX handler. XXE sink by default.
0.parseString()Sinkxml.sax.parseString(string, handler, error_handler=...) -> None
Parses XML from a string. XXE sink.
0.make_parser()Sinkxml.sax.make_parser(parser_list=()) -> XMLReader
Creates a SAX parser. XXE-prone unless external entities are disabled.
| FQN | Field | |
|---|---|---|
| xml.sax | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
from codepathfinder.go_rule import PyXmlSax