<div dir="ltr">Hi Mattia,<br><br>Actually I havent. Looks like minidom is vulnerable to both<br>[billion laughs] and [quadratic blowup]. <br><br>Should we migrate to defusexml? What you think? (:<br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">2017-07-21 14:22 GMT-03:00 Mattia Rizzolo <span dir="ltr"><<a href="mailto:mattia@debian.org" target="_blank">mattia@debian.org</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Fri, Jul 21, 2017 at 10:48:07AM +0100, Chris Lamb wrote:<br>
> … And I've now also merged the code into our Git repo. Thanks!<br>
<br>
</span>Did you both go through<br>
<a href="https://docs.python.org/3/library/xml.html#xml-vulnerabilities" rel="noreferrer" target="_blank">https://docs.python.org/3/<wbr>library/xml.html#xml-<wbr>vulnerabilities</a> and<br>
decided that the standard minidom was safe for our usages?<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
regards,<br>
                        Mattia Rizzolo<br>
<br>
GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.<br>
more about me:  <a href="https://mapreri.org" rel="noreferrer" target="_blank">https://mapreri.org</a>                             : :'  :<br>
Launchpad user: <a href="https://launchpad.net/~mapreri" rel="noreferrer" target="_blank">https://launchpad.net/~mapreri</a>                  `. `'`<br>
Debian QA page: <a href="https://qa.debian.org/developer.php?login=mattia" rel="noreferrer" target="_blank">https://qa.debian.org/<wbr>developer.php?login=mattia</a>  `-<br>
</div></div></blockquote></div><br></div>