Use defusedxml for XML parsing

Close #588
CZ-NIC · Jan 24, 2019 · aa56b0a · aa56b0a
1 parent f0b0cda
commit aa56b0a
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,12 +7,16 @@ The format is based on the [KeepAChangeLog] project.
 
 ## Unreleased
 
+### Changed
+- [#588] Switch to defusedxml for XML parsing
+
 ### Fixed
 - [#592] Do not append cookie header if there is nothing to append
 - [#591] Fix verification of encrypted id_token
 
 [#592]: https://github.com/OpenIDC/pyoidc/issues/592
 [#591]: https://github.com/OpenIDC/pyoidc/issues/591
+[#588]: https://github.com/OpenIDC/pyoidc/issues/588
 
 ## 0.15.0 [2019-01-17]
 

diff --git a/setup.py b/setup.py
@@ -89,6 +89,7 @@ def run_tests(self):
         "cryptography",
         "future",
         "six",
+        "defusedxml",
     ] + extra_install_requires,
     tests_require=tests_requires,
     zip_safe=False,

diff --git a/src/oic/utils/authn/user_cas.py b/src/oic/utils/authn/user_cas.py
@@ -5,10 +5,10 @@
 import json
 import logging
 import uuid
-import xml.etree.ElementTree as ET
 
 import requests
 import six
+from defusedxml import ElementTree as ET
 
 from oic.utils.authn.user import UserAuthnMethod
 from oic.utils.http_util import SeeOther