Release v0.1.8

src/govoplan_calendar/backend/service.py

@@ -13,6 +13,7 @@ from datetime import datetime, timedelta, timezone
 from typing import Any, Callable
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
+from defusedxml import ElementTree as SafeElementTree
 from sqlalchemy import or_
 from sqlalchemy.orm import Session
 
@@ -1375,8 +1376,8 @@ def ews_find_item_body(*, start: datetime, end: datetime, mailbox: Any | None =
 
 def parse_ews_calendar_items(xml_text: str) -> list[dict[str, Any]]:
     try:
-        root = ET.fromstring(xml_text)
-    except ET.ParseError as exc:
+        root = SafeElementTree.fromstring(xml_text)
+    except SafeElementTree.ParseError as exc:
         raise CalendarError(f"Invalid EWS response XML: {exc}") from exc
     items: list[dict[str, Any]] = []
     for item in root.findall(f".//{{{EWS_TYPES_NS}}}CalendarItem"):