enhancementhelp wanted
仓库指标
- 星标
- (7 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
In https://github.com/madpah/serializable/pull/5, defusedxml has been introduced as a dependency to prevent XEE attacks.
According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:
- https://docs.python.org/3/library/xml.html#xml-security
- https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762
According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the mentioned attacks should not be possible with modern Python anymore.
Is the dependency still required here?