Use defusedxml library to reduce xml attack surface (#1002)

 replace ET.fromstring with defusedxml.fromstring

Author: jacalata

setup.py

@@ -33,6 +33,7 @@
     test_suite='test',
     setup_requires=pytest_runner,
     install_requires=[
+        'defusedxml>=0.7.1',
         'requests>=2.11,<3.0',
     ],
     tests_require=test_requirements,

tableauserverclient/__init__.py

@@ -1,4 +1,4 @@
-from .namespace import NEW_NAMESPACE as DEFAULT_NAMESPACE
+from ._version import get_versions
 from .models import (
     ConnectionCredentials,
     ConnectionItem,
@@ -37,6 +37,7 @@
     FlowRunItem,
     RevisionItem,
 )
+from .namespace import NEW_NAMESPACE as DEFAULT_NAMESPACE
 from .server import (
     RequestOptions,
     CSVRequestOptions,
@@ -50,7 +51,6 @@
     NotSignedInError,
     Pager,
 )
-from ._version import get_versions
 
 __version__ = get_versions()["version"]
 __VERSION__ = __version__

tableauserverclient/models/__init__.py

@@ -1,16 +1,16 @@
+from .column_item import ColumnItem
 from .connection_credentials import ConnectionCredentials
 from .connection_item import ConnectionItem
-from .column_item import ColumnItem
 from .data_acceleration_report_item import DataAccelerationReportItem
 from .data_alert_item import DataAlertItem
-from .datasource_item import DatasourceItem
 from .database_item import DatabaseItem
+from .datasource_item import DatasourceItem
 from .dqw_item import DQWItem
 from .exceptions import UnpopulatedPropertyError
 from .favorites_item import FavoriteItem
-from .group_item import GroupItem
 from .flow_item import FlowItem
 from .flow_run_item import FlowRunItem
+from .group_item import GroupItem
 from .interval_item import (
     IntervalItem,
     DailyInterval,
@@ -20,20 +20,20 @@
 )
 from .job_item import JobItem, BackgroundJobItem
 from .pagination_item import PaginationItem
+from .permissions_item import PermissionsRule, Permission
+from .personal_access_token_auth import PersonalAccessTokenAuth
+from .personal_access_token_auth import PersonalAccessTokenAuth
 from .project_item import ProjectItem
+from .revision_item import RevisionItem
 from .schedule_item import ScheduleItem
 from .server_info_item import ServerInfoItem
 from .site_item import SiteItem
+from .subscription_item import SubscriptionItem
+from .table_item import TableItem
 from .tableau_auth import TableauAuth
-from .personal_access_token_auth import PersonalAccessTokenAuth
 from .target import Target
-from .table_item import TableItem
 from .task_item import TaskItem
 from .user_item import UserItem
 from .view_item import ViewItem
-from .workbook_item import WorkbookItem
-from .subscription_item import SubscriptionItem
-from .permissions_item import PermissionsRule, Permission
 from .webhook_item import WebhookItem
-from .personal_access_token_auth import PersonalAccessTokenAuth
-from .revision_item import RevisionItem
+from .workbook_item import WorkbookItem

tableauserverclient/models/column_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+from defusedxml.ElementTree import fromstring
 
 from .property_decorators import property_not_empty
 
@@ -47,7 +47,7 @@ def _set_values(self, id, name, description, remote_type):
     @classmethod
     def from_response(cls, resp, ns):
         all_column_items = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_column_xml = parsed_response.findall(".//t:column", namespaces=ns)
 
         for column_xml in all_column_xml:

tableauserverclient/models/connection_item.py

@@ -1,4 +1,5 @@
-import xml.etree.ElementTree as ET
+from defusedxml.ElementTree import fromstring
+
 from .connection_credentials import ConnectionCredentials
 
 
@@ -39,7 +40,7 @@ def __repr__(self):
     @classmethod
     def from_response(cls, resp, ns):
         all_connection_items = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_connection_xml = parsed_response.findall(".//t:connection", namespaces=ns)
         for connection_xml in all_connection_xml:
             connection_item = cls()

tableauserverclient/models/data_acceleration_report_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+from defusedxml.ElementTree import fromstring
 
 
 class DataAccelerationReportItem(object):
@@ -70,7 +70,7 @@ def _parse_element(comparison_record_xml, ns):
     @classmethod
     def from_response(cls, resp, ns):
         comparison_records = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_comparison_records_xml = parsed_response.findall(".//t:comparisonRecord", namespaces=ns)
         for comparison_record_xml in all_comparison_records_xml:
             (

tableauserverclient/models/data_alert_item.py

@@ -1,15 +1,12 @@
-import xml.etree.ElementTree as ET
+from typing import List, Optional, TYPE_CHECKING
+
+from defusedxml.ElementTree import fromstring
 
 from .property_decorators import (
     property_not_empty,
     property_is_enum,
     property_is_boolean,
 )
-from .user_item import UserItem
-from .view_item import ViewItem
-
-
-from typing import List, Optional, TYPE_CHECKING
 
 if TYPE_CHECKING:
     from datetime import datetime
@@ -181,7 +178,7 @@ def _set_values(
     @classmethod
     def from_response(cls, resp, ns) -> List["DataAlertItem"]:
         all_alert_items = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_alert_xml = parsed_response.findall(".//t:dataAlert", namespaces=ns)
 
         for alert_xml in all_alert_xml:

tableauserverclient/models/database_item.py

@@ -1,11 +1,11 @@
-import xml.etree.ElementTree as ET
+from defusedxml.ElementTree import fromstring
 
+from .exceptions import UnpopulatedPropertyError
 from .property_decorators import (
     property_is_enum,
     property_not_empty,
     property_is_boolean,
 )
-from .exceptions import UnpopulatedPropertyError
 
 
 class DatabaseItem(object):
@@ -254,7 +254,7 @@ def _set_data_quality_warnings(self, dqw):
     @classmethod
     def from_response(cls, resp, ns):
         all_database_items = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_database_xml = parsed_response.findall(".//t:database", namespaces=ns)
 
         for database_xml in all_database_xml:

tableauserverclient/models/datasource_item.py

@@ -1,4 +1,9 @@
+import copy
 import xml.etree.ElementTree as ET
+from typing import Dict, List, Optional, Set, Tuple, TYPE_CHECKING
+
+from defusedxml.ElementTree import fromstring
+
 from .exceptions import UnpopulatedPropertyError
 from .property_decorators import (
     property_not_nullable,
@@ -7,9 +12,6 @@
 )
 from .tag_item import TagItem
 from ..datetime_helpers import parse_datetime
-import copy
-
-from typing import Dict, List, Optional, Set, Tuple, TYPE_CHECKING, Union
 
 if TYPE_CHECKING:
     from .permissions_item import PermissionsRule
@@ -189,7 +191,7 @@ def _set_revisions(self, revisions):
 
     def _parse_common_elements(self, datasource_xml, ns):
         if not isinstance(datasource_xml, ET.Element):
-            datasource_xml = ET.fromstring(datasource_xml).find(".//t:datasource", namespaces=ns)
+            datasource_xml = fromstring(datasource_xml).find(".//t:datasource", namespaces=ns)
         if datasource_xml is not None:
             (
                 ask_data_enablement,
@@ -294,7 +296,7 @@ def _set_values(
     @classmethod
     def from_response(cls, resp: str, ns: Dict) -> List["DatasourceItem"]:
         all_datasource_items = list()
-        parsed_response = ET.fromstring(resp)
+        parsed_response = fromstring(resp)
         all_datasource_xml = parsed_response.findall(".//t:datasource", namespaces=ns)
 
         for datasource_xml in all_datasource_xml:

tableauserverclient/models/dqw_item.py

@@ -1,4 +1,5 @@
-import xml.etree.ElementTree as ET
+from defusedxml.ElementTree import fromstring
+
 from ..datetime_helpers import parse_datetime
 
 
@@ -98,7 +99,7 @@ def updated_at(self, value):
 
     @classmethod
     def from_response(cls, resp, ns):
-        return cls.from_xml_element(ET.fromstring(resp), ns)
+        return cls.from_xml_element(fromstring(resp), ns)
 
     @classmethod
     def from_xml_element(cls, parsed_response, ns):