Feat/security improvements (#81)

* 🔒 refactor: replace xml with defused xml

fixes #80, to fix the security attacks that can happen using the xml.dom
from stdlib. defusedxml is API compatible and easy to replace that fixes
these security issues, so why not. Adds an extra dependency but is
worth it.

* 🔖 feat: version bump

* 🎨 feat: pin dependencies

* 📦 feat: packages are installed from a new file

Author: vinitkumar

.github/workflows/pythonpackage.yml

@@ -25,7 +25,7 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install pytest
-        pip install -r requirements_prod.txt
+        pip install -r requirements.txt
         python setup.py install
     - name: Lint with flake8
       run: |

.gitignore

@@ -1,4 +1,5 @@
 .idea
+.tox
 *.pyc
 json2xml.egg-info
 build

json2xml/__init__.py

@@ -4,7 +4,7 @@
 
 __author__ = """Vinit Kumar"""
 __email__ = "[email protected]"
-__version__ = "3.7.0"
+__version__ = "3.8.0"
 
 
 # from .utils import readfromurl, readfromstring, readfromjson

json2xml/dicttoxml.py

@@ -5,8 +5,7 @@
 import logging
 import numbers
 from random import randint
-from xml.dom.minidom import parseString
-
+from defusedxml.minidom import parseString
 
 from typing import Dict, Any
 

json2xml/json2xml.py

@@ -1,6 +1,6 @@
 # -*- coding: utf-8 -*-
 from typing import Optional, Any
-from xml.dom.minidom import parseString
+from defusedxml.minidom import parseString
 from json2xml import dicttoxml
 
 

requirements.in

@@ -0,0 +1,5 @@
+requests>=2.20.0
+defusedxml==0.7.1
+pytest
+xmltodict
+

requirements.txt

@@ -0,0 +1,44 @@
+#
+# This file is autogenerated by pip-compile with python 3.7
+# To update, run:
+#
+#    pip-compile
+#
+attrs==21.2.0
+    # via pytest
+certifi==2021.5.30
+    # via requests
+charset-normalizer==2.0.6
+    # via requests
+defusedxml==0.7.1
+    # via -r requirements.in
+idna==3.2
+    # via requests
+importlib-metadata==4.8.1
+    # via
+    #   pluggy
+    #   pytest
+iniconfig==1.1.1
+    # via pytest
+packaging==21.0
+    # via pytest
+pluggy==1.0.0
+    # via pytest
+py==1.10.0
+    # via pytest
+pyparsing==2.4.7
+    # via packaging
+pytest==6.2.5
+    # via -r requirements.in
+requests==2.26.0
+    # via -r requirements.in
+toml==0.10.2
+    # via pytest
+typing-extensions==3.10.0.2
+    # via importlib-metadata
+urllib3==1.26.7
+    # via requests
+xmltodict==0.12.0
+    # via -r requirements.in
+zipp==3.6.0
+    # via importlib-metadata

requirements_dev.txt

@@ -12,7 +12,7 @@
 with open("HISTORY.rst") as history_file:
     history = history_file.read()
 
-requirements = [open("requirements_prod.txt").read()]
+requirements = [open("requirements.txt").read()]
 
 setup_requirements = []