Merge pull request #352 from vasiliadi/feature/defusedxml

[security] defusedxml.ElementTree instead of xml.etree.ElementTree
jdepoix · Nov 18, 2024 · 729e804 · 729e804
2 parents ceda81b + b473e69
commit 729e804
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 3 deletions.
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -49,6 +49,7 @@ precommit.shell = "poe format && poe lint && poe coverage"
 [tool.poetry.dependencies]
 python = ">=3.8,<3.14"
 requests = "*"
+defusedxml = "^0.7.1"
 
 [tool.poetry.group.test]
 optional = true

diff --git a/youtube_transcript_api/_transcripts.py b/youtube_transcript_api/_transcripts.py
@@ -8,7 +8,7 @@
 
 import json
 
-from xml.etree import ElementTree
+from defusedxml import ElementTree
 
 import re