Update Qualys WebApp parser to use DefusedXML

[Maffooch]

The Qualys WebApp parser is not using defusedXML like the rest of the parsers. This needs to change as defusedXML is widely considered to be the more secure option

[sc-7039]

[dryrunsecurity]

DryRun Security Summary

The provided code change focuses on enhancing the security of the Qualys WebApp parser by addressing a potential XML External Entity (XXE) vulnerability through the use of the defusedxml.ElementTree module and the ElementTree.parse() function from the defusedxml module.

Expand for full summary

Summary:

The provided code change is focused on enhancing the security of the Qualys WebApp parser by addressing a potential XML External Entity (XXE) vulnerability. The key changes include:

1. Replacing the use of the standard xml.etree.ElementTree module with the defusedxml.ElementTree module, which is designed to prevent XXE attacks.
2. Updating the xml.etree.ElementTree.parse() function call to use the ElementTree.parse() function from the defusedxml module.

These changes are a proactive security measure to mitigate the risk of XXE vulnerabilities in the Qualys WebApp parser. XXE vulnerabilities can allow attackers to access sensitive data or perform other malicious actions, so replacing the standard XML parsing library with a more secure alternative is a recommended security practice.

Files Changed:

• dojo/tools/qualys_webapp/parser.py: This file has been updated to replace the use of the standard xml.etree.ElementTree module with the defusedxml.ElementTree module, and the xml.etree.ElementTree.parse() function call has been updated to use the ElementTree.parse() function from the defusedxml module. These changes are intended to address potential XXE vulnerabilities in the Qualys WebApp parser.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[mtesauro]

Approved

[manuel-sommer]

Hi @Maffooch .
Do you think this PR does have a chance to get merged: #9840 ?