From 7e452d9913f9bfd2046aada1108c1c78d44ec5e7 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 09:13:11 +0000
Subject: [PATCH] fix: resolve CodeQL alert #33 - XML internal entity expansion

---
 vulnerable_xxe.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vulnerable_xxe.py b/vulnerable_xxe.py
index b9fc887..f2bb496 100644
--- a/vulnerable_xxe.py
+++ b/vulnerable_xxe.py
@@ -47,7 +47,8 @@ def upload_xml():
     xml_file = request.files['file']
     content = xml_file.read()
     
-    root = ET.fromstring(content)
+    import defusedxml.ElementTree as SafeET
+    root = SafeET.fromstring(content)
     
     return f"Uploaded: {root.tag}"