enhancementhelp wanted
Métriques du dépôt
- Stars
- (7 étoiles)
- Métriques de merge PR
- (Métriques PR en attente)
Description
In https://github.com/madpah/serializable/pull/5, defusedxml has been introduced as a dependency to prevent XEE attacks.
According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:
- https://docs.python.org/3/library/xml.html#xml-security
- https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762
According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.
Is the dependency still required here?