Add defusedxml as an (optional) way to prevent XML-based attacks

Those attacks are DoS-only.

1 files changed, 4 insertions, 1 deletions

diff --git a/libmat2/office.py b/libmat2/office.py
index 14621d4..0d0c795 100644
--- a/libmat2/office.py
+++ b/libmat2/office.py
@@ -4,8 +4,11 @@ import shutil
 import tempfile
 import datetime
 import zipfile
-import xml.etree.ElementTree as ET
 from typing import Dict, Set, Pattern
+try:  # protect against DoS
+    from defusedxml import ElementTree as ET
+except ImportError:
+    import xml.etree.ElementTree as ET
 
 
 from . import abstract, parser_factory