pySCG investigate on creating CWE-91 Prevent XML injection #986
Description
Missing code examples that are suitable in terms of length and need to install additional modules.
XML as such is similar to html not python but we do have rule's on html such as CWE-472.
Challenging to avoid using a module from outside of the standard lib in the code examples.
CVEs that could lead to an alternative code example (CWE-91):
CVE-2021-36359 (nist.gov)
CVE-2018-1000632 (nist.gov)
CVE-2022-46751 (nist.gov)
Its mostly an issue due to disabling of a DTD or lack of using one and lack of input sanitation. Subsequently an attacker has a greater choice in how the xml is arranged. Input sanitation can furthermore limit the attack vector.