From 28b6124cf53f7316ebca4fa3ad3dfc5e299231d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 1 Mar 2022 19:07:56 +0100
Subject: [PATCH] Protect against XML vulnerabilities

issue11219
issue11244
(grafted from f801a89c84e7df1e3ae00b0f91d500ed7d36a7a9)

--HG--
branch : 6.0
---
 CHANGELOG         | 2 ++
 proteus/config.py | 4 ++++
 setup.py          | 1 +
 3 files changed, 7 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 9d15e56538..a18d618bc5 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* Use defusedxml to parse XML (11244)
+
 Version 6.0.4 - 2022-01-15
 * Bug fixes (see mercurial logs for details)
 
diff --git a/proteus/config.py b/proteus/config.py
index e2244eb606..5373be56ba 100644
--- a/proteus/config.py
+++ b/proteus/config.py
@@ -11,8 +11,12 @@ import urllib.parse
 import xmlrpc.client
 from decimal import Decimal
 
+import defusedxml.xmlrpc
+
 __all__ = ['set_trytond', 'set_xmlrpc', 'get_config']
 
+defusedxml.xmlrpc.monkey_patch()
+
 
 def dump_decimal(self, value, write):
     value = {'__class__': 'Decimal',
diff --git a/setup.py b/setup.py
index 94e82c2e1a..25f0c40fe2 100755
--- a/setup.py
+++ b/setup.py
@@ -98,6 +98,7 @@ setup(name=name,
     license='LGPL-3',
     python_requires='>=3.6',
     install_requires=[
+        'defusedxml',
         "python-dateutil",
         ],
     extras_require={