fileaudit.xml_check module

License MPL-2.0 (C) 2026 Created by Maikel Mardjan - https://nocomplexity.com/ FileAudit - XML Security Checker with DDoS Protection

exception fileaudit.xml_check.FileValidationError(message)

Bases: Exception

Custom exception for XML validation failures in FileAudit.

class fileaudit.xml_check.HTTPSOnlyRedirectHandler

Bases: HTTPRedirectHandler

Redirect handler that blocks any redirect to a non-HTTPS URL. Prevents downgrade attacks (e.g. https -> http redirects).

redirect_request(req, fp, code, msg, headers, newurl)

Return a Request or None in response to a redirect.

This is called by the http_error_30x methods when a redirection response is received. If a redirection should take place, return a new Request to allow http_error_30x to perform the redirect. Otherwise, raise HTTPError if no-one else should try to handle this url. Return None if you can’t but another Handler might.

class fileaudit.xml_check.XMLSecurityValidator(max_depth=None, max_file_size=None, max_attributes=None, max_elements=None, max_text_length=None, max_name_length=None)

Bases: object

XML security validator with comprehensive DDoS protection.

reset_counters()

Reset internal counters.

secure_parse(xml_content)

Parse XML and validate it against security limits.

fileaudit.xml_check.validate_xml(func_or_path=None, max_depth=None, max_file_size=None, max_attributes=None, max_elements=None, max_text_length=None, max_name_length=None)

Validate XML files via decorator or direct invocation.

An XML file validator that can operate in two modes:

1. Decorator mode — wraps a function to validate an XML file path passed as an argument before the function body runs.

2. Direct call / CLI mode — validates a file immediately and returns a boolean result.

Usage:

@validate_xml @validate_xml() @validate_xml(“custom_arg_name”, max_depth=50) @validate_xml(max_file_size=5000) validate_xml(“path/to/file.xml”, max_depth=10)

Parameters:

• func_or_path (callable, str, pathlib.Path, or None) –

  • If a callable: the function to decorate (bare decorator usage: @validate_xml).

  • If a str or Path that looks like a file path or URL: the file path to validate (direct call usage).

  • If a str that is a valid Python identifier (not a path): treated as the target argument name to inspect in decorator mode (e.g., @validate_xml("config_path")).

  • If None: returns a decorator factory (@validate_xml() or @validate_xml(max_depth=50)).

• max_depth (int or None) – Maximum allowed XML nesting depth. Falls back to DEFAULT_MAX_DEPTH if omitted.

• max_file_size (int or None) – Maximum allowed file size in bytes. Falls back to DEFAULT_MAX_FILE_SIZE if omitted.

• max_attributes (int or None) – Maximum number of attributes permitted per XML element. Falls back to DEFAULT_MAX_ATTRIBUTES if omitted.

• max_elements (int or None) – Maximum number of XML elements allowed in the document. Falls back to DEFAULT_MAX_ELEMENTS if omitted.

• max_text_length (int or None) – Maximum permitted length of text or attribute values. Falls back to DEFAULT_MAX_TEXT_LENGTH if omitted.

• max_name_length (int or None) – Maximum permitted length of element and attribute names. Falls back to DEFAULT_MAX_NAME_LENGTH if omitted.

Returns:

• In decorator mode: the wrapped function.

• In direct call mode: True if validation passes, False if it fails (errors are printed to stdout).

Return type:

Union[callable, bool, function]

Raises:

• FileValidationError – If validation fails in decorator mode, or if

• the decorated function has no arguments, the target argument is –

• missing, or the argument type is not str or Path. –