Parse and import statement into database

[mark-stopka]

Take XML vulnerabilities into consideration, when parsing XLSX

There are many attack vectors targeting XML parsers; by default most are susceptible to all or most of the known vulnerabilities. There is DefuseXML Python library to help mitigate against attacks by malicious XML files obtained from non-trusted sources. When working with XLSX documents using xlrd, following wrapper can be used to harden against these attacks.

import defusedxml
from defusedxml.common import EntitiesForbidden
from xlrd import open_workbook
defusedxml.defuse_stdlib()


def secure_open_workbook(**kwargs):
    try:
        return open_workbook(**kwargs)
    except EntitiesForbidden:
        raise ValueError('Please use a xlsx file without XEE')