diff options
| author | Christian Heimes <christian@cheimes.de> | 2013-02-20 13:11:46 +0100 |
|---|---|---|
| committer | Christian Heimes <christian@cheimes.de> | 2013-02-20 13:11:46 +0100 |
| commit | cc3a5aa4fa54a6c62bae91365d44f75189885b7c (patch) | |
| tree | b466189b44ae6b824e6c0346801004a8dfe6dfbf | |
| parent | 3e53a48a70cfc4c0dd70c1e54f93cd5eb35d592d (diff) | |
| parent | 2d5655bd19b4828d7f5670aeb67e04ab1d07f5ac (diff) | |
| download | defusedxml-cc3a5aa4fa54a6c62bae91365d44f75189885b7c.tar.gz | |
merge
| -rw-r--r-- | README.txt | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -159,7 +159,7 @@ DTD retrieval ------------- This case is similar to external entity expansion, too. Some XML libraries -like Python's xml.dom.pulldown retrieve document type definitions from remote +like Python's xml.dom.pulldom retrieve document type definitions from remote or local locations. Several attack scenarios from the external entity case apply to this issue as well. @@ -501,7 +501,7 @@ lzma is even better:: 148K zeros.xy None of Python's standard XML libraries decompress streams except for -``xmlrpclib``. The module vulnerable <http://bugs.python.org/issue16043> +``xmlrpclib``. The module is vulnerable <http://bugs.python.org/issue16043> to decompression bombs. lxml can load and process compressed data through libxml2 transparently. |