Skip to content

Commit 049e8ef

Browse files
committed
Fix Snyk CWE-611: Insecure Xml Parser (XXE/DDoS)
Use defusedxml.ElementTree instead of xml.etree.ElementTree in Scripts/generate_html_report.py and Scripts/generate_enhanced_html_report.py, and add Scripts/requirements.txt with defusedxml>=0.7.0.
1 parent a8efe37 commit 049e8ef

3 files changed

Lines changed: 7 additions & 5 deletions

File tree

Scripts/generate_enhanced_html_report.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
- Expected vs Actual values
66
- HTTP Request details (including cURL)
77
- Response details
8-
No external dependencies - uses only Python standard library
8+
Uses defusedxml for secure XML parsing (XXE/DDoS-safe).
99
"""
1010

11-
import xml.etree.ElementTree as ET
11+
import defusedxml.ElementTree as ET
1212
import os
1313
import sys
1414
import re

Scripts/generate_html_report.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#!/usr/bin/env python3
22
"""
33
HTML Test Report Generator for .NET Test Results
4-
Converts .trx files to beautiful HTML reports
5-
No external dependencies - uses only Python standard library
4+
Converts .trx files to beautiful HTML reports.
5+
Uses defusedxml for secure XML parsing (XXE/DDoS-safe).
66
"""
77

8-
import xml.etree.ElementTree as ET
8+
import defusedxml.ElementTree as ET
99
import os
1010
import sys
1111
from datetime import datetime

Scripts/requirements.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Secure XML parsing (fixes Snyk CWE-611 Insecure Xml Parser / XXE)
2+
defusedxml>=0.7.0

0 commit comments

Comments
 (0)