Code RoomXML bomb via billion laughs

MediumPrep Room Coding #2066

XML bomb via billion laughs

Code reviewCode quality & reviewMid–Senior~20 min

Review this Python endpoint that parses a user-uploaded XML config, with external entities already disabled.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 20 min

Mark a line and say what kind of problem it is.0 findings

1from lxml import etree

2

3@app.route('/import', methods=['POST'])

4def import_config():

5 xml_bytes = request.get_data()

6 parser = etree.XMLParser(resolve_entities=False, no_network=True)

7 try:

8 root = etree.fromstring(xml_bytes, parser=parser)

9 except etree.XMLSyntaxError:

10 return {'error': 'invalid xml'}, 400

11 config = {el.tag: el.text for el in root}

12 save_config(config)

13 return {'imported': len(config)}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.