Now using defusedxml to fix a known vulnerability https://docs.pyth…

…on.org/3/library/xml.etree.elementtree.html. Fixes #11

genbadge/utils_coverage.py

@@ -7,7 +7,15 @@
 from __future__ import division
 
 from .utils_badge import Badge
-from xml.etree import ElementTree
+
+try:
+    # security patch: see https://docs.python.org/3/library/xml.etree.elementtree.html
+    import defusedxml
+except ImportError as e:
+    class FakeDefusedXmlImport(object):
+        def __getattribute__(self, item):
+            raise ImportError("Could not import `defusedxml` module, please install it. Caught: %r" % e)
+    defusedxml = FakeDefusedXmlImport()
 
 
 class CoverageStats(object):
@@ -114,7 +122,7 @@ class CovParser(object):
     """Parser class - inspired by the code in `xunitparser`"""
 
     def parse(self, source):
-        xml = ElementTree.parse(source)
+        xml = defusedxml.ElementTree.parse(source)
         root = xml.getroot()
         return self.parse_root(root)
 

genbadge/utils_junit.py

@@ -15,6 +15,10 @@
 try:
     # xunitparser is an optional dependency, do not fail if it cant be loaded
     import xunitparser
+    # security patch: see https://docs.python.org/3/library/xml.etree.elementtree.html
+    # to remove when https://github.com/laurentb/xunitparser/issues/14 is fixed
+    from defusedxml import ElementTree
+    setattr(xunitparser, "ElementTree", ElementTree)
 except ImportError as e:
     class FakeXunitParserImport(object):
         def __getattribute__(self, item):

setup.cfg

@@ -78,12 +78,14 @@ exclude =
 # Optional dependencies that can be installed with e.g.  $ pip install -e .[dev,test]
 [options.extras_require]
 tests =
+    defusedxml
     xunitparser
 coverage =
-
+    defusedxml
 flake8 =
     flake8-html
 all =
+    defusedxml
     xunitparser
     flake8-html