Safe XML parsing#

This chapter explains the design decisions made for safe XML parsing in icalendar.

RFC 6321 specifies how to represent calendars as XML.

In summary, Python's built-in XML parser is reasonably safe to parse XML for xCal.

Sources#

The following sources have been taken into consideration:

  1. Python 3.12 XML package still mentions defusedxml.

  2. Python 3.13 XML package does not mention defusedxml.

  3. Amended documentation recommendation

    "Python 3.11-3.15 include expat 2.7.1 which is not vulnerable."

  4. Discussion on defusedxml

  5. RUFF checker flagging built-in XML parser

  6. defusedxml analysis

  7. xinclude support

People who use icalendar may parse unverified, external XML. Therefore, the XML parser should be safe. If it isn't safe, then icalendar can refuse to parse content, and raise a exception that refers to a solution.

Conclusion#

Python 3.10 ships with expat >= 2.4.1. According to defusedxml analysis, XML parsing is safe in Python 3.10.

Python 3.11 or later ships expat >= 2.7.1. According to Amended documentation recommendation, in these Python versions, XML parsing is safe.

icalendar's pyproject.toml file requires a Python version that is safe for XML parsing. Therefore, icalendar is safe to use its configured built-in XML parsing.

Developers can open an issue to use a different XML parser. The parser is configurable through the setting icalendar.config.parse_xml().

See also

icalendar.tests.rfc_6321_xcal.test_xml_parser