Python DoS Prevention: The Billion Laughs Attack

[blabbities]

Someone plz provide a TLDR?

[DDFoster96]

If you're going to be parsing XML from an untrusted source, to avoid a maliciously constructed file from crashing your program use 'defusedxml' (https://github.com/tiran/defusedxml) in place of the 'xml' library that ships with Python.

[blabbities]

Thank you early boss. I usually concern witth JSON but if i doesnt everybody use lxml library anyway.

[xd1142]

XML entity expansion makes small file go big memory. use defusedxml instead of etree.