rules:
- id: use-defused-xml
  fix-regex:
    regex: xml
    replacement: defusedxml
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://docs.python.org/3/library/xml.html
    - https://github.com/tiran/defusedxml
    category: security
    technology:
    - python
  message: >-
    Found use of the native Python XML libraries, which is vulnerable to XML external
    entity (XXE)
    attacks. The Python documentation recommends the 'defusedxml' library instead.
    Use 'defusedxml'.
    See https://github.com/tiran/defusedxml for more information.
  languages: [python]
  severity: ERROR
  pattern: import xml