DeprecationWarning: defusedxml.lxml is no longer supported #956

Activity

1. markp2 commented on Jul 22, 2019

   

   markp2

   on Jul 22, 2019

   More actions

   I am hitting this issue too with Zeep 3.4.0:

   /Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/zeep/loader.py:3:

   DeprecationWarning: defusedxml.lxml is no longer supported and will be removed in a future release.
     from defusedxml.lxml import fromstring
   

   The problem line is:

   from defusedxml.lxml import fromstring

   👍React with 👍7Reacted by Deniz, Kurt Abersold, Quentin, sorech02, Michael Thompson, Alessio Bogon and Leo Noordergraaf
2. robodoo

   added a commit that references this issue on Feb 4, 2020

   [FIX] *: leftover deprecation warnings

   ...

   06d22de
3. jaap3 commented on Jun 18, 2020

   

   jaap3

   on Jun 18, 2020

   Author

   More actions

   There's some more information in this ticket: tiran/defusedxml#38, short summary, the module isn't going away until there's some alternative
4. arjitkgupta commented on Sep 6, 2020

   

   arjitkgupta

   on Sep 6, 2020

   More actions

   Is this issue or #1014 fixed and released ?
   I am getting the same error with below.
   Python 3.6.1
   pytest 5.4.2
   zeep 3.4.0
5. akeeman commented on Sep 7, 2020

   

   akeeman

   on Sep 7, 2020

   Last edited by akeeman

   Contributor

   More actions

   There's some more information in this ticket: tiran/defusedxml#38, short summary, the module isn't going away until there's some alternative.

   So Zeep is using defusedxml while deprecated while there is no alternative and it's not likely to not go away anytime soon.
   Normally there are two things that can happen: (1) Zeep switches to something else (not available so not a real option) or (2) defusedxml removes the warning for now (not a Zeep issue). A nasty third could be to suppress the warning in Zeep, but that hides the fact that it is what it is: using a deprecated third party feature.

   So I'd say it's your decision if you want the warning to be gone: (run before importing zeep stuff)

   import warnings
   warnings.filterwarnings("ignore", "defusedxml.lxml is no longer supported and will be removed in a future release.", DeprecationWarning)

   Or just filter in the log:

   import logging
   
   logging.getLogger(*you logger here*).addFilter(lambda record: "defusedxml.lxml is no longer supported" not in message)
   # may be:
   # logging.root.addFilter(lambda record: "defusedxml.lxml is no longer supported" not in message)

   👍React with 👍1Reacted by AbsoluteVirtue
6. xmo-odoo commented on Nov 27, 2020

   

   xmo-odoo

   on Nov 27, 2020

   More actions

   According to defusedxml and lxml's own documentation, there's no need for a replacement because the protection of defused are largely built into lxml: when parsing a document it's possible to opt-out of resolving entities (which is the primary "internal" vulnerability of lxml according to defused's table), and then do whatever is desirable on the Entity nodes that leaves in the document, whether it's ignoring them, asserting there are none, stripping them out, or even resolving an acceptable subset of them. All that's missing is at best some amount of convenience for the latter part (deciding what to do with the entity nodes if they don't get resolved).

   👍React with 👍1Reacted by spumer
7. mvantellingen

   closed this as completedin #1179on Apr 11, 2021