enh: defusedxml

[taylorwilsdon]

Closes #526

Summary by CodeRabbit

• Bug Fixes
  • Enhanced XML parsing with safer parsing mechanisms for improved robustness.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes swap the XML parsing implementation from the standard library's ElementTree to defusedxml's safer variant in the extract_office_xml_text function, and add defusedxml as a project dependency. Public function behavior remains unchanged.

Changes

Cohort / File(s)	Summary
Security Enhancement core/utils.py	Updated extract_office_xml_text to use defusedxml.ElementTree instead of standard library xml.etree.ElementTree for safer XML parsing. Docstring updated to reflect new dependency.
Dependency Addition pyproject.toml	Added defusedxml>=0.7.1 to project dependencies.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A safer parse, a change so keen,
Defusedxml keeps XML clean,
No XXE attacks shall pass our gate,
Security strengthens—simply great! 🔒

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided by the author, making it impossible to verify compliance with the repository's required template structure and guidelines.	Add a comprehensive pull request description following the template, including: brief description of changes, type of change selection, testing confirmation, and checklist items (especially enabling 'Allow edits from maintainers').
Title check	❓ Inconclusive	The title 'enh: defusedxml' is vague and generic, using a prefix without clearly describing what the enhancement accomplishes or why defusedxml is being added.	Expand the title to be more descriptive, such as 'Add defusedxml for secure XML parsing' or 'Use defusedxml to prevent XML vulnerabilities' to clarify the purpose of this change.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch issues/526

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}