use defusedxml

parsons/scytl/scytl.py

@@ -1,11 +1,11 @@
 import csv
 import typing as t
-import xml.etree.ElementTree as ET
 import zipfile
 from dataclasses import dataclass
 from datetime import datetime
 from io import BytesIO, StringIO
 
+import defusedxml.ElementTree as ET
 import requests
 from dateutil.parser import parse as parsedate
 from pytz import timezone

parsons/targetsmart/targetsmart_automation.py

@@ -24,8 +24,8 @@
 import logging
 import time
 import uuid
-import xml.etree.ElementTree as ET
 
+import defusedxml.ElementTree as ET
 import xmltodict
 
 from parsons.etl.table import Table

requirements.txt

@@ -9,6 +9,7 @@ civis==1.16.1
 curlify==2.2.1
 dbt_redshift==1.4.0
 docutils<0.18,>=0.14
+defusedxml>=0.7.1, <=0.8.0
 facebook-business==13.0.0
 google-api-core==2.19.2
 google-api-python-client==1.7.7

setup.py

@@ -59,10 +59,11 @@ def main():
             ],
             "s3": ["boto3"],
             "salesforce": ["simple-salesforce"],
+            "scytl": ["defusedxml", "pytz"],
             "sftp": ["paramiko"],
             "slack": ["slackclient<2"],
             "smtp": ["validate-email"],
-            "targetsmart": ["xmltodict"],
+            "targetsmart": ["xmltodict", "defusedxml"],
             "twilio": ["twilio"],
             "ssh": [
                 "sshtunnel",