Here's a documentation patch (Made against the 2.7 branch) that adds warning to the various xml modules to warn about the insecurity and points towards defusedxml/defusedexpat.

I feel like there should be a warning in Doc/library/xml.rst too.

Is there any actual reason why we don’t ship defusedxml with Python and add an easy way to monkeypatch so there’s as little passive barriers as possible to use XML “safely”?

I’m sorry I didn’t speak up on when this was discussed on the ML but I found the discussion…depressing.

Donald: Thanks! I'm going to look at your patch later today.

Hynek: Because the preferred way is another: use patched expat and pyexpat C modules of defusedexpat. It's a fix on C level and still allows a sane amount of entity expansions. defusedxml disallows any XML document that smells even a tiny bit. This approach needs a) more reviews and b) an API to enable the limitations-

Updated patch with more infos and also a link to defusedexpat.

Update looks fine to me, I'm not the best at docs I just wanted to get at least a jumping off point.

LGTM.

Benjaman and Georg, what do the RMs feel about the doc patch?

* I would take out the "erroneous" of "erroneous or maliciously constructed" in the disclaimers.  The odds of creating one of the "bombings" by chance are slim.

* The names of attacks in the table are quite opaque if you haven't heard of them.  They should be linked/explained.  (Also, the csv-table construction looks quite strange; a normal reST table would be preferred.)

* I don't think the warning for SAX needs to be repeated three times.

* Not sure the reader will get the reason for having both "defusedxml" and "defusedexpat".

1. sounds fine to me

2. I can copy some text from the README.txt of defusedxml. CSV table was easier to maintain for me. What's a good tool to create and modify sphinx tables?

3. No strong opinion here, better safe than sorry?

4. IMO the warning should mention both. Perhaps a better explanation will help?

FWIW I put the warning on all the sax pages just because there's no way to know which page a user will go to if they are coming in via google.

2. That would be good.  For this table the "simple" rst tables should be fine:

=====  =====
head   head
=====  =====
body   body
body   body
=====  =====

3. Once per XML logical handling module/package seems quite enough.

4. The warnings only link to the section about "XML Vulnerabilities", which is good.  But that section should not only mention that the defusedxml description explains everything, but also *what the hell* it contains :)

Here we go again!

I still see "erroneous" in there... otherwise looks good to me.

New changeset e7795a178b0a by Christian Heimes in branch '3.2':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/e7795a178b0a

New changeset 65e8ac5f073f by Christian Heimes in branch '3.3':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/65e8ac5f073f

New changeset 1ebefb6ae9a9 by Christian Heimes in branch 'default':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/1ebefb6ae9a9

New changeset e87364449954 by Christian Heimes in branch '2.7':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/e87364449954

New changeset 91bb6d7ae833 by Christian Heimes in branch '2.7':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/91bb6d7ae833

New changeset f45902f8c7d7 by Christian Heimes in branch '3.2':
Issue 17538: Document XML vulnerabilties
http://hg.python.org/cpython/rev/f45902f8c7d7

Christian: there are people strongly disagreeing with the description of minidom as “lightweight”, could you edit the libary/xml.rst file you added to say “minimal” instead?  See c2ae1ed03853 and #11379 if you want more info.