Repository navigation
Fix external entities vulnerability - #35
Conversation
| from setuptools import setup | ||
|
|
||
| setup(name='pyforce', | ||
| version='1.7.3', # be sure to update the version in pyforce.py too |
There was a problem hiding this comment.
Didn't see any version number in pyforce.py, let me know if I missed something @alanjcastonguay
There was a problem hiding this comment.
That's no longer true. And you removed the comment as part of your change. Awesome~
| @@ -0,0 +1 @@ | |||
| defusedxml==0.5.0 | |||
There was a problem hiding this comment.
Not sure if you want a requirements.txt, thoughts @alanjcastonguay?
| setup(name='pyforce', | ||
| version='1.7.3', # be sure to update the version in pyforce.py too | ||
| version='1.8.0', | ||
| install_requires=['defusedxml==0.5.0'], |
There was a problem hiding this comment.
This specific version, or anything higher than it?
There was a problem hiding this comment.
Good catch, added defusedxml>=0.5.0
ellieayla
left a comment
ellieayla
left a comment
There was a problem hiding this comment.
Can (should?) you make this a version range, for anything that doesn't break major compatibility?
|
I acknowledge that Salesforce can be the attacking party here. But is the vector you're concerned about some untrusted party submitting stuff to Salesforce, and then this library reading it back out? |
|
I'm not sure what you mean by "version range", can you elaborate? I'm not that experienced w/ PyPi versioning. |
That's what I meant. |
I'm just concerned about Salesforce being compromised/rogue employee, I know a few people that work there (security people) and they're great, but if e.g a developer said they wanted to take a response from even Google and put it into |
|
Then I agree with your assessment and remediation. Thanks for the fix. |
|
Oh okay, awesome @alanjcastonguay 👍 Great OSS experience! |
|
@alanjcastonguay Would you be okay with putting the latest (1.8.0) up on https://pypi.python.org/pypi/pyforce? Cheers. |
|
Tagged commit d69a73c as 1.8.0: https://pypi.python.org/pypi/pyforce/1.8.0 |
So in xmltramp it uses a library called xml.sax
https://github.com/alanjcastonguay/pyforce/blob/master/src/pyforce/xmltramp.py#L5
So the xml sax library is one of only 2 libraries vulnerable to XML External Entity Expansion
(https://docs.python.org/2/library/xml.html#xml-vulnerabilities)
If Salesforce gets compromised or has a rogue employee they can probe the network using it and send requests to anything, potentially getting remote code execution. For more information about XXE visit https://en.wikipedia.org/wiki/XML_external_entity_attack