XML200.md

XML200

Enabling the allow_dotted_names option allows intruders to access your module’s global variables and may allow intruders to execute arbitrary code on your machine.

Example

from xmlrpc.server import SimpleXMLRPCServer


with SimpleXMLRPCServer(('0.0.0.0', 8000),) as server:
    class MyFuncs:
        def mul(self, x, y):
            return x * y

    server.register_instance(MyFuncs(), allow_dotted_names=True)  # This is bad!

    # Run the server's main loop
    server.serve_forever()

Fixes

• Disable this option
• Only use within a secure, local network

See Also

• Official Documentation