TS Lib XML #

Version #

v0.1.2

Table of Contents #

Summary#

This library provides access to XML parsing functions and libraries which have been secured against XML attack vectors. This is achieved using the defusedxml library, which is a drop-in replacement for the standard xml library.

Getting Started#

First, install this library from JFrog in your poetry environment:

poetry add ts-lib-xml

To use a specific library which has been secured, import it from the ts_lib_xml package instead of the original package. See the Modules section for examples of using each of the currently supported libraries.

Modules#

ts_lib_xml.pydantic_xml#

This module is a drop-in replacement for the pydantic_xml library, which has been secured against XML attack vectors using defusedxml.

To start using the secured pydantic-xml you can import the module, or import specific classes & functions from the module just how you can with the original library:

from ts_lib_xml import pydantic_xml

or

from ts_lib_xml.pydantic_xml import BaseXmlModel, ...

For more details on the contents and usage of pydantic-xml, see the pydantic-xml documentation.

ts_lib_xml.xml_to_dict#

This module contains secure functions to convert XML to a python dictionary, built using defusedxml.

This module contains the function xml_string_to_dict, which converts an XML string to a pytho dictionary according to this XML-to-JSON specification.

Here is an example of how to use the function:

from ts_lib_xml.xml_to_dict import xml_string_to_dict

XML_SNIPPET = """<?xml version="1.0" encoding="UTF-8"?>
<Company trade-name="SpaceX">
    <website>https://www.spacex.com</website>
    <product status="running" launched="2013">Several launch vehicles</product>
    <product status="running" launched="2019">Starlink</product>
    <product status="development">Starship</product>
</Company>"""

result = xml_string_to_dict(XML_SNIPPET)

assert result == {
  "Company": {
    "website": "https://www.spacex.com",
    "product": [
        {
            "@status": "running",
            "@launched": "2013",
            "#text": "Several launch vehicles",
        },
        {"@status": "running", "@launched": "2019", "#text": "Starlink"},
        {"@status": "development", "#text": "Starship"},
    ],
    "@trade-name": "SpaceX",
  }
}

Changelog#

v0.1.2#

  • Add LICENSE

v0.1.1#

  • Update supported python versions to >=3.8,<3.12

  • Add tox configuration to run tests on all supported python versions

v0.1.0#

  • Add ts_lib_xml.pydantic_xml, which provides defused access to the pydantic_xml library

  • Add ts_lib_xml.xml_to_dict module containing functions to convert XML to a python dictionaries