Protect against XML DOS attacks

Only XML content from authenticated users is parsed.
2020-01-19 18:39:31 +01:00
parent 562d3aacec
commit e11661ff3e
3 changed files with 6 additions and 4 deletions
--- a/setup.py
+++ b/setup.py
@@ -73,7 +73,8 @@ setup(
        exclude=["*.tests", "*.tests.*", "tests.*", "tests"]),
    package_data={"radicale": WEB_FILES},
    entry_points={"console_scripts": ["radicale = radicale.__main__:run"]},
-    install_requires=["passlib", "vobject>=0.9.6", "python-dateutil>=2.7.3"],
+    install_requires=["defusedxml", "passlib", "vobject>=0.9.6",
+                      "python-dateutil>=2.7.3"],
    setup_requires=pytest_runner,
    tests_require=tests_require,
    extras_require={