diff --git a/pyproject.toml b/pyproject.toml index e5a330c39..5e006766a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -13,7 +13,7 @@ license-files = ["LICENSE"] readme = "README.md" dependencies = [ - 'defusedxml>=0.7.1', # latest as at 7/31/23 + 'defusedxml>=0.7.1', # latest as at 7/31/23; use for all XML parsing — stdlib xml is unsafe against XXE. XML building (Element/SubElement/tostring) still uses stdlib as defusedxml has no equivalents. 'packaging>=23.1', # latest as at 7/31/23 'requests>=2.32', # latest as at 7/31/23 'urllib3>=2.6.0,<3', diff --git a/tableauserverclient/models/collection_item.py b/tableauserverclient/models/collection_item.py index 786e9492b..e696c615d 100644 --- a/tableauserverclient/models/collection_item.py +++ b/tableauserverclient/models/collection_item.py @@ -1,5 +1,5 @@ from datetime import datetime -from xml.etree.ElementTree import Element +from xml.etree.ElementTree import Element # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring from typing_extensions import Self diff --git a/tableauserverclient/models/data_freshness_policy_item.py b/tableauserverclient/models/data_freshness_policy_item.py index 439d53caa..80a53018f 100644 --- a/tableauserverclient/models/data_freshness_policy_item.py +++ b/tableauserverclient/models/data_freshness_policy_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from tableauserverclient.models.property_decorators import property_is_enum, property_not_nullable from .interval_item import IntervalItem diff --git a/tableauserverclient/models/datasource_item.py b/tableauserverclient/models/datasource_item.py index 6ed1fbdd4..2a106eb06 100644 --- a/tableauserverclient/models/datasource_item.py +++ b/tableauserverclient/models/datasource_item.py @@ -1,6 +1,6 @@ import copy import datetime -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/extract_item.py b/tableauserverclient/models/extract_item.py index d8a149ec4..2d157a87a 100644 --- a/tableauserverclient/models/extract_item.py +++ b/tableauserverclient/models/extract_item.py @@ -1,5 +1,5 @@ from defusedxml.ElementTree import fromstring -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml class ExtractItem: diff --git a/tableauserverclient/models/flow_item.py b/tableauserverclient/models/flow_item.py index ede80915c..3382218d5 100644 --- a/tableauserverclient/models/flow_item.py +++ b/tableauserverclient/models/flow_item.py @@ -1,7 +1,7 @@ from collections.abc import Iterable import copy import datetime -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/groupset_item.py b/tableauserverclient/models/groupset_item.py index da1e88f8d..c92a8a800 100644 --- a/tableauserverclient/models/groupset_item.py +++ b/tableauserverclient/models/groupset_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring from typing_extensions import Self diff --git a/tableauserverclient/models/location_item.py b/tableauserverclient/models/location_item.py index e1ecd0039..a52cea33f 100644 --- a/tableauserverclient/models/location_item.py +++ b/tableauserverclient/models/location_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml class LocationItem: diff --git a/tableauserverclient/models/metric_item.py b/tableauserverclient/models/metric_item.py index 287ebc8a1..fdaed2f5e 100644 --- a/tableauserverclient/models/metric_item.py +++ b/tableauserverclient/models/metric_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +from defusedxml.ElementTree import fromstring # parsing server responses; defusedxml protects against XML attacks from datetime import datetime from tableauserverclient.datetime_helpers import parse_datetime @@ -127,7 +127,7 @@ def from_response( ns, ) -> list["MetricItem"]: all_metric_items = list() - parsed_response = ET.fromstring(resp) + parsed_response = fromstring(resp) all_metric_xml = parsed_response.findall(".//t:metric", namespaces=ns) for metric_xml in all_metric_xml: all_metric_items.append(cls.from_xml(metric_xml, ns)) diff --git a/tableauserverclient/models/permissions_item.py b/tableauserverclient/models/permissions_item.py index 3603c37c4..cf24c6320 100644 --- a/tableauserverclient/models/permissions_item.py +++ b/tableauserverclient/models/permissions_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/project_item.py b/tableauserverclient/models/project_item.py index 70adc8a76..e7103bc58 100644 --- a/tableauserverclient/models/project_item.py +++ b/tableauserverclient/models/project_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from typing import overload from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/schedule_item.py b/tableauserverclient/models/schedule_item.py index d15a15345..1ef2fa4ac 100644 --- a/tableauserverclient/models/schedule_item.py +++ b/tableauserverclient/models/schedule_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from datetime import datetime from typing import TYPE_CHECKING diff --git a/tableauserverclient/models/server_info_item.py b/tableauserverclient/models/server_info_item.py index b13f26740..86d8dd12b 100644 --- a/tableauserverclient/models/server_info_item.py +++ b/tableauserverclient/models/server_info_item.py @@ -1,6 +1,6 @@ import logging import warnings -import xml +from xml.etree.ElementTree import ParseError # exception class only; defusedxml raises this same class from defusedxml.ElementTree import fromstring from tableauserverclient.helpers.logging import logger @@ -61,7 +61,7 @@ def rest_api_version(self): def from_response(cls, resp, ns): try: parsed_response = fromstring(resp) - except xml.etree.ElementTree.ParseError as error: + except ParseError as error: logger.exception(f"Unexpected response for ServerInfo: {resp}") return cls("Unknown", "Unknown", "Unknown") except Exception as error: diff --git a/tableauserverclient/models/site_item.py b/tableauserverclient/models/site_item.py index 382ca63db..86c545afb 100644 --- a/tableauserverclient/models/site_item.py +++ b/tableauserverclient/models/site_item.py @@ -1,5 +1,5 @@ import warnings -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/tag_item.py b/tableauserverclient/models/tag_item.py index cde755f05..e7cac335f 100644 --- a/tableauserverclient/models/tag_item.py +++ b/tableauserverclient/models/tag_item.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/user_item.py b/tableauserverclient/models/user_item.py index 0ba1e8eb2..55bb56b2d 100644 --- a/tableauserverclient/models/user_item.py +++ b/tableauserverclient/models/user_item.py @@ -1,5 +1,5 @@ import io -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from datetime import datetime from enum import IntEnum from typing import TYPE_CHECKING diff --git a/tableauserverclient/models/virtual_connection_item.py b/tableauserverclient/models/virtual_connection_item.py index 7ec2efe36..abbb92396 100644 --- a/tableauserverclient/models/virtual_connection_item.py +++ b/tableauserverclient/models/virtual_connection_item.py @@ -2,7 +2,7 @@ import json from typing import Callable from collections.abc import Iterable -from xml.etree.ElementTree import Element +from xml.etree.ElementTree import Element # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/webhook_item.py b/tableauserverclient/models/webhook_item.py index a8dfe3ef0..110218fcf 100644 --- a/tableauserverclient/models/webhook_item.py +++ b/tableauserverclient/models/webhook_item.py @@ -1,5 +1,5 @@ import re -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/models/workbook_item.py b/tableauserverclient/models/workbook_item.py index 352923389..fa3e94fee 100644 --- a/tableauserverclient/models/workbook_item.py +++ b/tableauserverclient/models/workbook_item.py @@ -1,7 +1,7 @@ import copy import datetime import uuid -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # type annotation only; parsing uses defusedxml from typing import Callable, overload from defusedxml.ElementTree import fromstring diff --git a/tableauserverclient/server/endpoint/endpoint.py b/tableauserverclient/server/endpoint/endpoint.py index 31a0806dc..4b1e2126a 100644 --- a/tableauserverclient/server/endpoint/endpoint.py +++ b/tableauserverclient/server/endpoint/endpoint.py @@ -8,7 +8,7 @@ import abc from packaging.version import Version from functools import wraps -from xml.etree.ElementTree import ParseError +from xml.etree.ElementTree import ParseError # exception type only; defusedxml raises this same class from typing import ( Any, Callable, diff --git a/tableauserverclient/server/request_factory.py b/tableauserverclient/server/request_factory.py index fc4694c01..44e234647 100644 --- a/tableauserverclient/server/request_factory.py +++ b/tableauserverclient/server/request_factory.py @@ -1,4 +1,4 @@ -import xml.etree.ElementTree as ET +import xml.etree.ElementTree as ET # building XML request bodies only; use defusedxml for parsing from typing import Any, Callable, TypeVar, TYPE_CHECKING from collections.abc import Iterable