security-and-privacy/mat2
security-and-privacy/mat2
1
0
Fork 0
mirror of synced 2025-07-03 11:57:26 +02:00
Code Releases Activity

Remove defusedxml support and document why

Browse source
This commit is contained in:
jvoisin 2018-09-05 18:41:08 +02:00
parent 3649c0ccaf
commit 072ee1814d
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
doc/implementation_notes.md
View file

@ -61,3 +61,11 @@ Images handling
When possible, images are handled like PDF: rendered on a surface, then saved
to the filesystem. This ensures that every metadata is removed.
XML attacks
-----------
Since our thread model conveniently excludes files crafted to specifically
bypass MAT2, fileformats containing harmful XML are out of our scope.
But since MAT2 is using [etree](https://docs.python.org/3/library/xml.html#xml-vulnerabilities)
to process XML, it's "only" vulnerable to DoS, and not memory corruption:
odds are that the user will notice that the cleaning didn't succeed.