Security audit - B411 #1025

README.rst

@@ -59,6 +59,8 @@ Requirements
 
 - ``python>=2.7`` or ``python>=3.4``
 - ``psutil>=5.3.0`` (better with latest version)
+- ``defusedxml`` (in order to monkey path xmlrpc)
+- ``future`` (for Python 2 support)
 
 *Note for Python 2.6 users*
 
@@ -66,6 +68,10 @@ Glances no longer supports Python 2.6. Please upgrade
 to a minimum Python version of 2.7/3.4+ or downgrade to Glances 2.6.2 (last version
 with Python 2.6 support).
 
+*Deprecation warning note for Python 2.x users*
+
+Glances version 4.0 will no longer supports Python 2.x.
+
 Optional dependencies:
 
 - ``bernhard`` (for the Riemann export module)

glances/compat.py

@@ -44,6 +44,10 @@ if PY3:
     from urllib.error import HTTPError, URLError
     from urllib.parse import urlparse
 
+    # Correct issue #1025 by monkey path the xmlrpc lib
+    from defusedxml.xmlrpc import monkey_patch
+    monkey_patch()
+
     input = input
     range = range
     map = map
@@ -132,6 +136,10 @@ else:
     from urllib2 import urlopen, HTTPError, URLError
     from urlparse import urlparse
 
+    # Correct issue #1025 by monkey path the xmlrpc lib
+    from defusedxml.xmlrpc import monkey_patch
+    monkey_patch()
+
     input = raw_input
     range = xrange
     ConfigParser.read_file = ConfigParser.readfp

optional-requirements.txt

@@ -10,7 +10,7 @@ docker>=2.0.0
 elasticsearch
 graphitesender
 hddtemp
-influxdb
+influxdb>=1.0.0
 influxdb-client; python_version >= "3.6"
 kafka-python
 netifaces

requirements.txt

@@ -1,2 +1,3 @@
 psutil>=5.3.0
+defusedxml
 future

setup.py

@@ -41,7 +41,7 @@ def get_data_files():
 
 
 def get_install_requires():
-    requires = ['psutil>=5.3.0', 'future']
+    requires = ['psutil>=5.3.0', 'defusedxml', 'future']
     if sys.platform.startswith('win'):
         requires.append('bottle')
         requires.append('requests')
@@ -60,7 +60,6 @@ def get_install_extras_require():
                    'paho-mqtt', 'potsdb', 'prometheus_client', 'pyzmq',
                    'statsd'],
         'folders': ['scandir'],  # python_version<"3.5"
-        'gpu': ['py3nvml'],
         'graph': ['pygal'],
         'ip': ['netifaces'],
         'raid': ['pymdstat'],
@@ -70,6 +69,10 @@ def get_install_extras_require():
         'web': ['bottle', 'requests'],
         'wifi': ['wifi']
     }
+    if PY3:
+        extras_require['export'].append('influxdb-client')
+        extras_require['gpu'] = ['py3nvml']
+
     # Add automatically the 'all' target
     extras_require.update({'all': [i[0] for i in extras_require.values()]})