Use defusedxml for safer XML parsing

CHANGES.md

@@ -6,7 +6,11 @@ core specification version. Versions 1.0.x implement the v1.0
 ResourceSync specification which was standardized as ANSI/NISO Z39.99-2014
 <http://www.openarchives.org/rs/1.0/toc>.
 
-v1.0.0 2014-06-XX
+v1.0.1 2016-01-30
+  * Improved test coverage
+  * Use defusedxml for safer XML parsing
+
+v1.0.0 2014-06-18
   * Update for v1.0, Z39.99-2014 specification (http://www.openarchives.org/rs/1.0/)
   * Partial implementation of dump output (no read yet)
 

README

@@ -101,7 +101,7 @@ Thanks to:
 Copyright and License
 ---------------------
 
-Copyright 2012--2014 Simeon Warner
+Copyright 2012--2016 Simeon Warner
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

resync/resource_list_builder.py

@@ -19,7 +19,7 @@ import re
 import time
 import logging
 from urllib import URLopener
-from xml.etree.ElementTree import parse
+from defusedxml.ElementTree import parse
 
 from resource import Resource
 from resource_list import ResourceList

resync/sitemap.py

@@ -4,7 +4,8 @@ import re
 import os
 import sys
 import logging
-from xml.etree.ElementTree import ElementTree, Element, parse, tostring
+from defusedxml.ElementTree import parse
+from xml.etree.ElementTree import ElementTree, Element, tostring
 import StringIO
 
 from resource import Resource

setup.py

@@ -37,7 +37,8 @@ setup(
     url='http://github.com/resync/resync',
     install_requires=[
         "requests",
-        "python-dateutil>=1.5"
+        "python-dateutil>=1.5",
+        "defusedxml>=0.41"
     ],
     test_suite="resync.test",
 )