some fixes

Open-MSS · Dec 13, 2024 · 57c030b · 57c030b
1 parent 2edcc42
commit 57c030b
Show file tree

Hide file tree

Showing 5 changed files with 10 additions and 8 deletions.
diff --git a/mslib/msui/flighttrack.py b/mslib/msui/flighttrack.py
@@ -39,8 +39,9 @@
 import os
 
 import fs
-import xml.dom.minidom
-import xml.parsers.expat
+import xml.dom.minidom  # nosec
+import defusedxml.minidom
+from defusedxml import DefusedXmlException
 
 from PyQt5 import QtGui, QtCore, QtWidgets
 
@@ -97,8 +98,8 @@ def seconds_to_string(seconds):
 
 def load_from_xml_data(xml_content, name="Flight track"):
     try:
-        doc = xml.dom.minidom.parseString(xml_content)
-    except xml.parsers.expat.ExpatError as ex:
+        doc = defusedxml.minidom.parseString(xml_content)
+    except DefusedXmlException as ex:
         raise SyntaxError(str(ex))
 
     ft_el = doc.getElementsByTagName("FlightTrack")[0]

diff --git a/mslib/mswms/mpl_lsec.py b/mslib/mswms/mpl_lsec.py
@@ -27,7 +27,7 @@
 # style definitions should be put in mpl_lsec_styles.py
 
 import logging
-from xml.dom.minidom import getDOMImplementation
+from xml.dom.minidom import getDOMImplementation  # nosec
 import matplotlib as mpl
 from pint import Quantity
 

diff --git a/mslib/mswms/mpl_vsec.py b/mslib/mswms/mpl_vsec.py
@@ -33,7 +33,7 @@
 import logging
 import numpy as np
 from abc import abstractmethod
-from xml.dom.minidom import getDOMImplementation
+from xml.dom.minidom import getDOMImplementation  # nosec
 import matplotlib as mpl
 from matplotlib.backends.backend_agg import FigureCanvasAgg as FigureCanvas
 import mpl_toolkits.axes_grid1

diff --git a/mslib/mswms/wms.py b/mslib/mswms/wms.py
@@ -52,7 +52,7 @@
 import werkzeug
 import urllib.parse
 
-from xml.etree import ElementTree
+from defusedxml import ElementTree
 from chameleon import PageTemplateLoader
 from owslib.crs import axisorder_yx
 from PIL import Image

diff --git a/mslib/utils/__init__.py b/mslib/utils/__init__.py
@@ -85,9 +85,10 @@ def setup_logging(args):
             logger.addHandler(fh)
 
 
+# ToDo likly this can be removed in python 3 because that uses unicode
 # modified Version from minidom, https://github.com/python/cpython/blob/2.7/Lib/xml/dom/minidom.py
 # MSS needed to change all writings as unicode not str
-from xml.dom.minidom import _write_data, Node
+from xml.dom.minidom import _write_data, Node  # nosec
 # Copyright © 2001-2018 Python Software Foundation. All rights reserved.
 # Copyright © 2000 BeOpen.com. All rights reserved.