[Security] Fix CodeQL alert #33: XML internal entity expansion

[colin-d-fried]

Summary

Fixes CodeQL alert #33: XML internal entity expansion

Field	Value
Severity	high
File	vulnerable_xxe.py
CWE	CWE-776
Alert	CodeQL Alert #33

Fix Applied

See the diff for the specific secure coding change applied.

Fixes #35

---

---

Note

Low Risk
Low risk, localized change that only swaps the XML parser used by the /upload_xml endpoint. Main risk is potential behavior differences or parse errors for previously accepted XML inputs.

Overview
Updates the /upload_xml endpoint in vulnerable_xxe.py to parse uploaded XML with defusedxml.ElementTree (SafeET.fromstring) instead of the standard xml.etree.ElementTree, mitigating XML internal entity expansion (XXE/Billion Laughs) issues.

^{Written by Cursor Bugbot for commit 7e452d9. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Missing defusedxml dependency in project Pipfile

High Severity

The fix imports defusedxml.ElementTree but defusedxml is not declared as a dependency in Pipfile (or Pipfile.lock). This means the /upload_xml endpoint will raise an ImportError at runtime because the package won't be installed in the environment. The security fix effectively breaks the endpoint entirely.