Replaced standard XML module with 'defusedxml' for XML bomb protection

mufeedvh · web-flow · commit ade6207078cc · 2020-02-14T18:49:25.000+05:30
diff --git a/libnmap/parser.py b/libnmap/parser.py
@@ -2,9 +2,9 @@
 
 
 try:
-    import xml.etree.cElementTree as ET
+    import defusedxml.cElementTree as parseXML
 except ImportError:
-    import xml.etree.ElementTree as ET
+    import defusedxml.ElementTree as parseXML
 from libnmap.objects import NmapHost, NmapService, NmapReport
 
 
@@ -87,7 +87,7 @@ def _parse_xml(cls, nmap_data=None, incomplete=False):
             nmap_data += "</nmaprun>"
 
         try:
-            root = ET.fromstring(nmap_data)
+            root = parseXML.fromstring(nmap_data)
         except:
             raise NmapParserException("Wrong XML structure: cannot parse data")
 
