Use xml.etree through defusedxml (#19640)

homeassistant/components/ihc/__init__.py

@@ -6,7 +6,6 @@ https://home-assistant.io/components/ihc/
 """
 import logging
 import os.path
-import xml.etree.ElementTree
 
 import voluptuous as vol
 
@@ -24,7 +23,7 @@ from homeassistant.helpers import discovery
 import homeassistant.helpers.config_validation as cv
 from homeassistant.helpers.typing import HomeAssistantType
 
-REQUIREMENTS = ['ihcsdk==2.2.0']
+REQUIREMENTS = ['ihcsdk==2.2.0', 'defusedxml==0.5.0']
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -217,11 +216,13 @@ def get_manual_configuration(
 def autosetup_ihc_products(hass: HomeAssistantType, config, ihc_controller,
                            controller_id):
     """Auto setup of IHC products from the IHC project file."""
+    from defusedxml import ElementTree
+
     project_xml = ihc_controller.get_project()
     if not project_xml:
         _LOGGER.error("Unable to read project from IHC controller")
         return False
-    project = xml.etree.ElementTree.fromstring(project_xml)
+    project = ElementTree.fromstring(project_xml)
 
     # if an auto setup file exist in the configuration it will override
     yaml_path = hass.config.path(AUTO_SETUP_YAML)

homeassistant/components/namecheapdns.py

@@ -14,6 +14,8 @@ from homeassistant.const import CONF_HOST, CONF_PASSWORD, CONF_DOMAIN
 from homeassistant.helpers.event import async_track_time_interval
 from homeassistant.helpers.aiohttp_client import async_get_clientsession
 
+REQUIREMENTS = ['defusedxml==0.5.0']
+
 _LOGGER = logging.getLogger(__name__)
 
 DOMAIN = 'namecheapdns'
@@ -55,7 +57,7 @@ async def async_setup(hass, config):
 
 async def _update_namecheapdns(session, host, domain, password):
     """Update namecheap DNS entry."""
-    import xml.etree.ElementTree as ET
+    import defusedxml.ElementTree as ET
 
     params = {
         'host': host,

homeassistant/components/sensor/ohmconnect.py

@@ -6,7 +6,6 @@ https://home-assistant.io/components/sensor.ohmconnect/
 """
 import logging
 from datetime import timedelta
-import xml.etree.ElementTree as ET
 
 import requests
 import voluptuous as vol
@@ -17,6 +16,8 @@ import homeassistant.helpers.config_validation as cv
 from homeassistant.util import Throttle
 from homeassistant.helpers.entity import Entity
 
+REQUIREMENTS = ['defusedxml==0.5.0']
+
 _LOGGER = logging.getLogger(__name__)
 
 CONF_ID = 'id'
@@ -68,6 +69,8 @@ class OhmconnectSensor(Entity):
     @Throttle(MIN_TIME_BETWEEN_UPDATES)
     def update(self):
         """Get the latest data from OhmConnect."""
+        import defusedxml.ElementTree as ET
+
         try:
             url = ("https://login.ohmconnect.com"
                    "/verify-ohm-hour/{}").format(self._ohmid)

requirements_all.txt

@@ -295,7 +295,10 @@ datapoint==0.4.3
 # homeassistant.components.light.decora_wifi
 # decora_wifi==1.3
 
+# homeassistant.components.ihc
+# homeassistant.components.namecheapdns
 # homeassistant.components.device_tracker.upc_connect
+# homeassistant.components.sensor.ohmconnect
 defusedxml==0.5.0
 
 # homeassistant.components.sensor.deluge

requirements_test_all.txt

@@ -52,7 +52,10 @@ caldav==0.5.0
 # homeassistant.components.sensor.coinmarketcap
 coinmarketcap==5.0.3
 
+# homeassistant.components.ihc
+# homeassistant.components.namecheapdns
 # homeassistant.components.device_tracker.upc_connect
+# homeassistant.components.sensor.ohmconnect
 defusedxml==0.5.0
 
 # homeassistant.components.sensor.dsmr