mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
10 lines
319 B
Python
10 lines
319 B
Python
|
# Safe: tainted XML routed through defusedxml, which strips external-entity
|
||
|
|
# resolution. Treated as a Sanitizer(XXE), so taint-xxe stays clean.
|
||
|
|
import defusedxml.ElementTree
|
||
|
|
from flask import request
|
||
|
|
|
||
|
|
def handle():
|
||
|
|
body = request.args.get("xml")
|
||
|
|
tree = defusedxml.ElementTree.fromstring(body)
|
||
|
|
return tree
|