Improve XML parsing with defusedxml

dependencies/pip/dev_requirements.txt

@@ -1,6 +1,6 @@
 #
-# This file is autogenerated by pip-compile with python 3.10
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
 #
 #    pip-compile dependencies/pip/dev_requirements.in
 #
@@ -73,6 +73,7 @@ decorator==5.1.1
     #   ipython
 defusedxml==0.7.1
     # via
+    #   -r dependencies/pip/requirements.in
     #   djangorestframework-xml
     #   pyxform
 deprecated==1.2.13

dependencies/pip/requirements.in

@@ -13,6 +13,7 @@
 -e git+https://github.com/kobotoolbox/ssrf-protect@9b97d3f0fd8f737a38dd7a6b64efeffc03ab3cdd#egg=ssrf_protect
 
 # Regular PyPI packages
+defusedxml
 Django>=3.2,<3.3
 django-csp
 django-environ

dependencies/pip/requirements.txt

@@ -1,6 +1,6 @@
 #
-# This file is autogenerated by pip-compile with python 3.10
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
 #
 #    pip-compile dependencies/pip/requirements.in
 #
@@ -63,6 +63,7 @@ cryptography==37.0.0
     #   jwcrypto
 defusedxml==0.7.1
     # via
+    #   -r dependencies/pip/requirements.in
     #   djangorestframework-xml
     #   pyxform
 deprecated==1.2.13

onadata/apps/api/tests/viewsets/test_xform_viewset.py

@@ -2,13 +2,14 @@
 import os
 import re
 from io import StringIO
+from xml.dom import Node
 
 from django.conf import settings
 from django.urls import reverse
+from defusedxml import minidom
 from guardian.shortcuts import assign_perm
 from kobo_service_account.utils import get_request_headers
 from rest_framework import status
-from xml.dom import minidom, Node
 
 from onadata.apps.api.tests.viewsets.test_abstract_viewset import \
     TestAbstractViewSet

onadata/apps/logger/models/xform.py

@@ -2,7 +2,7 @@
 import json
 import os
 import re
-from xml.sax import saxutils
+from xml.sax.saxutils import escape as xml_escape
 
 from django.conf import settings
 from django.contrib.auth.models import User
@@ -162,7 +162,7 @@ def _set_title(self):
 
         if self.title and title_xml != self.title:
             title_xml = self.title[:XFORM_TITLE_LENGTH]
-            title_xml = saxutils.escape(title_xml)
+            title_xml = xml_escape(title_xml)
             self.xml = title_pattern.sub(
                 "<h:title>%s</h:title>" % title_xml, self.xml)
 

onadata/apps/logger/tests/test_parsing.py

@@ -1,7 +1,8 @@
 # coding: utf-8
 import os
 import re
-from xml.dom import minidom
+
+from defusedxml import minidom
 
 from onadata.apps.main.tests.test_base import TestBase
 from onadata.apps.logger.xform_instance_parser import XFormInstanceParser,\

onadata/apps/logger/xform_instance_parser.py

@@ -2,12 +2,13 @@
 import logging
 import re
 import sys
+from xml.dom import Node
 
 import dateutil.parser
 import six
+from defusedxml import minidom
 from django.utils.encoding import smart_str
 from django.utils.translation import gettext as t
-from xml.dom import minidom, Node
 
 from onadata.libs.utils.common_tags import XFORM_ID_STRING
 
@@ -126,7 +127,7 @@ def clean_and_parse_xml(xml_string):
 
 
 def _xml_node_to_dict(node, repeats=[]):
-    assert isinstance(node, minidom.Node)
+    assert isinstance(node, Node)
     if len(node.childNodes) == 0:
         # there's no data for this leaf node
         return None

onadata/apps/main/tests/test_process.py

@@ -6,13 +6,14 @@
 import re
 import unittest
 from io import BytesIO
+from xml.dom import Node
 
+from defusedxml import minidom
 from django.urls import reverse
 from django.conf import settings
 from django_digest.test import Client as DigestClient
 from django.core.files.uploadedfile import UploadedFile
 from openpyxl import load_workbook
-from xml.dom import minidom, Node
 
 from onadata.apps.main.models import MetaData
 from onadata.apps.logger.models import XForm