[pitboss] phase 05: Track J.3 + Track L.3 — XXE corpus + DocumentBuilder / lxml / libxml / SimpleXML adapters

tests/dynamic_fixtures/xxe/python/benign.py

@@ -0,0 +1,12 @@
+"""Phase 05 (Track J.3) — Python XXE benign fixture.
+
+Same parser surface as `vuln.py` but the parser is configured with
+`resolve_entities=False` and `no_network=True`, so the same payload's
+`<!ENTITY>` block is rejected and no entity body is substituted.
+"""
+from lxml import etree
+
+
+def run(body: bytes):
+    parser = etree.XMLParser(resolve_entities=False, no_network=True)
+    return etree.fromstring(body, parser=parser)

tests/dynamic_fixtures/xxe/python/vuln.py

@@ -0,0 +1,13 @@
+"""Phase 05 (Track J.3) — Python XXE vuln fixture.
+
+The function pulls XML bytes off the request and feeds them straight
+to `lxml.etree.XMLParser(resolve_entities=True)`, so any
+`<!ENTITY xxe SYSTEM "file:///…">` in the payload is resolved and its
+body substituted into the parsed tree.
+"""
+from lxml import etree
+
+
+def run(body: bytes):
+    parser = etree.XMLParser(resolve_entities=True)
+    return etree.fromstring(body, parser=parser)