devzilla/discordBot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Безопасность: замена xml.etree.ElementTree на defusedxml (защита от XXE-инъекций)

Browse Source
This commit is contained in:
deadzilla 2026-07-07 22:46:02 +05:00
parent 2d890bea98
commit 5a2f1630f6
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
requirements.txt
View File

@ -1,3 +1,4 @@
discord.py>=2.3.2 discord.py>=2.3.2
python-dotenv>=1.0.0 python-dotenv>=1.0.0
requests>=2.31.0 requests>=2.31.0
defusedxml>=7.0.0

4
utils/news.py
View File

@ -17,12 +17,12 @@ _session = requests.Session()
async def fetch_rss(url): async def fetch_rss(url):
"""Скачать и распарсить RSS-ленту (RSS 2.0 / Atom).""" """Скачать и распарсить RSS-ленту (RSS 2.0 / Atom)."""
await habr_rss_limiter.acquire() await habr_rss_limiter.acquire()
from xml.etree import ElementTree from defusedxml.ElementTree import fromstring
try: try:
response = await asyncio.to_thread(_session.get, url, timeout=10) response = await asyncio.to_thread(_session.get, url, timeout=10)
response.raise_for_status() response.raise_for_status()
root = ElementTree.fromstring(response.content) root = fromstring(response.content)
# RSS 2.0 # RSS 2.0
ns_dc = {"dc": "http://purl.org/dc/elements/1.1/"} ns_dc = {"dc": "http://purl.org/dc/elements/1.1/"}