Release v0.1.8

src/govoplan_files/backend/storage/connector_browse.py

@@ -11,6 +11,7 @@ from typing import Any
 from urllib.parse import quote, unquote, urljoin, urlsplit
 import xml.etree.ElementTree as ET
 
+from defusedxml import ElementTree as SafeElementTree
 import httpx
 
 from govoplan_files.backend.storage.connector_profiles import ConnectorProfile
@@ -70,8 +71,8 @@ def browse_connector_profile(profile: ConnectorProfile, *, path: str | None = No
 
 def parse_webdav_multistatus(*, root_url: str, current_path: str, payload: str | bytes) -> list[ConnectorBrowseItem]:
     try:
-        root = ET.fromstring(payload)
-    except ET.ParseError as exc:
+        root = SafeElementTree.fromstring(payload)
+    except SafeElementTree.ParseError as exc:
         raise ConnectorBrowseError("Connector returned invalid WebDAV XML") from exc
     root_path = _url_path_root(root_url)
     current = normalize_connector_browse_path(current_path)