use defusedxml for xml parsing

Author: geritwagner

colrev/env/tei_parser.py

@@ -6,13 +6,13 @@
 import re
 import typing
 from pathlib import Path
-from xml.etree.ElementTree import ElementTree as StdElementTree
-from xml.etree.ElementTree import ParseError
-from xml.etree.ElementTree import register_namespace
-from xml.etree.ElementTree import tostring
+from xml.etree.ElementTree import (
+    register_namespace,
+)  # nosec B405 - namespace registration only
 
 import requests
 from defusedxml import ElementTree as DefusedET
+from defusedxml.common import DefusedXmlException
 
 import colrev.env.grobid_service
 import colrev.exceptions as colrev_exceptions
@@ -147,8 +147,8 @@ def _create_tei(self) -> None:
                     xml_fstring = file.read()
                 self.root = DefusedET.fromstring(xml_fstring)
 
-                tree = StdElementTree(self.root)
-                tree.write(str(self.tei_path), encoding="utf-8")
+                with open(self.tei_path, "wb") as file:
+                    file.write(DefusedET.tostring(self.root, encoding="utf-8"))
         except requests.exceptions.ConnectionError as exc:  # pragma: no cover
             print(exc)
             print(str(self.pdf_path))
@@ -158,8 +158,8 @@ def get_tei_str(self) -> str:
         """Get the TEI string."""
         try:
             register_namespace("tei", "http://www.tei-c.org/ns/1.0")
-            return tostring(self.root, encoding="unicode")
-        except ParseError as exc:  # pragma: no cover
+            return DefusedET.tostring(self.root, encoding="unicode")
+        except (DefusedET.ParseError, DefusedXmlException) as exc:  # pragma: no cover
             raise colrev_exceptions.TEIException from exc
 
     def get_grobid_version(self) -> str:
@@ -731,8 +731,8 @@ def mark_references(self, *, records: dict):  # type: ignore
             # if settings file available: dedupe_io match agains records
 
         if self.tei_path:
-            tree = StdElementTree(self.root)
-            tree.write(str(self.tei_path))
+            with open(self.tei_path, "wb") as file:
+                file.write(DefusedET.tostring(self.root, encoding="utf-8"))
 
         return self.root
 

colrev/packages/pubmed/src/pubmed_api.py

@@ -7,10 +7,10 @@
 import typing
 from sqlite3 import OperationalError
 from xml.etree.ElementTree import Element  # nosec
-from xml.etree.ElementTree import ParseError
 
 import requests
 from defusedxml import ElementTree as DefusedET
+from defusedxml.common import DefusedXmlException
 
 import colrev.exceptions as colrev_exceptions
 import colrev.record.record
@@ -199,7 +199,7 @@ def query_id(self, *, pubmed_id: str) -> colrev.record.record.Record:
                 return retrieved_record
         except requests.exceptions.RequestException as exc:
             raise PubmedAPIError from exc
-        except ParseError as exc:
+        except (DefusedET.ParseError, DefusedXmlException) as exc:
             raise colrev_exceptions.RecordNotParsableException(
                 "Error parsing xml"
             ) from exc