Release v0.1.8

src/govoplan_calendar/backend/caldav.py

@@ -8,6 +8,8 @@ from dataclasses import dataclass, field
 from typing import Mapping, Protocol
 from xml.etree import ElementTree
 
+from defusedxml import ElementTree as SafeElementTree
+
 
 class CalDAVError(RuntimeError):
     pass
@@ -322,8 +324,8 @@ def urllib_transport(method: str, url: str, headers: Mapping[str, str], body: by
 
 def parse_multistatus(payload: bytes) -> CalDAVReportResult:
     try:
-        root = ElementTree.fromstring(payload)
-    except ElementTree.ParseError as exc:
+        root = SafeElementTree.fromstring(payload)
+    except SafeElementTree.ParseError as exc:
         raise CalDAVError(f"Invalid CalDAV XML response: {exc}") from exc
     objects: list[CalDAVObject] = []
     sync_token = first_child_text(root, "sync-token")
@@ -355,8 +357,8 @@ def parse_multistatus(payload: bytes) -> CalDAVReportResult:
 
 def parse_discovery_multistatus(payload: bytes) -> list[_DAVDiscoveryResponse]:
     try:
-        root = ElementTree.fromstring(payload)
-    except ElementTree.ParseError as exc:
+        root = SafeElementTree.fromstring(payload)
+    except SafeElementTree.ParseError as exc:
         raise CalDAVError(f"Invalid CalDAV XML response: {exc}") from exc
     responses: list[_DAVDiscoveryResponse] = []
     for response in child_elements(root, "response"):