enhancementhelp wanted
Repository metrics
- Stars
- (7 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
In https://github.com/madpah/serializable/pull/5, defusedxml has been introduced as a dependency to prevent XEE attacks.
According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:
- https://docs.python.org/3/library/xml.html#xml-security
- https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762
According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.
Is the dependency still required here?