Skip to content

Commit f004588

Browse files
fix(docs): use double backticks for inline literal in threat-model.rst
1 parent 32580d5 commit f004588

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

security/threat-model.rst

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ Data Formats & Parsing (``xml``, ``json``, ``tarfile``, ``zipfile``)
5454
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5555

5656
* **XML Parsing:** Standard :mod:`xml.etree.ElementTree` and :mod:`xml.dom.minidom` are vulnerable to XML entity expansion attacks (Billion Laughs) when parsing untrusted inputs. Users requiring secure XML parsing must use defusedxml.
57-
* **Archive Files:** Extracting untrusted archives using :mod:`tarfile` or :mod:`zipfile` without explicit path sanitization (e.g., using `filter='data'` in Python 3.12+) can overwrite arbitrary files.
57+
* **Archive Files:** Extracting untrusted archives using :mod:`tarfile` or :mod:`zipfile` without explicit path sanitization (e.g., using ``filter='data'`` in Python 3.12+) can overwrite arbitrary files.
58+
5859

5960
Process Execution (``subprocess``, ``os``)
6061
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

0 commit comments

Comments
 (0)