Use case
Currently the nmap injector relies on executing two subprocesses: calling nmap then calling jc (to parse the tool). jc happens to also be a Python library that could directly be called without going through subprocess (and managed through python packaging rather than linux packaging).
Plus, jc relies mainly on xmltodict and some YAML library that haven't been updatd in a while.
Plus², XML parsing can be quite dangerous in python (cf. defusedxml and lxml) so moving away from jc to have more control about the XML parsing could provided a safer code.
Current situation
Calling a Python tool as a CLI through subprocess
Proposed solution
Calling a Python library directly from the codebase (either keeping jc as the tool or replacing it with a more hands-on XML parser like lxml)
Use case
Currently the
nmapinjector relies on executing two subprocesses: callingnmapthen callingjc(to parse the tool).jchappens to also be a Python library that could directly be called without going throughsubprocess(and managed through python packaging rather than linux packaging).Plus,
jcrelies mainly onxmltodictand some YAML library that haven't been updatd in a while.Plus², XML parsing can be quite dangerous in python (cf.
defusedxmlandlxml) so moving away fromjcto have more control about the XML parsing could provided a safer code.Current situation
Calling a Python tool as a CLI through
subprocessProposed solution
Calling a Python library directly from the codebase (either keeping
jcas the tool or replacing it with a more hands-on XML parser likelxml)