Obsolete dependency on *defusedxml*?

[stefan6419846]

In 2ada4ad, defusedxml has been added as a dependency to the package to resolve some security warnings from bandit.

According to the docs, defusedxml should not be required anymore with recent Python versions and the recommendation for defusedxml has been removed from the official Python docs after some discussions:

• https://docs.python.org/3/library/xml.html#xml-security
• https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762

According to the table at https://github.com/tiran/defusedxml?tab=readme-ov-file#python-xml-libraries, the usual attacks should not be possible with modern Python anymore.

One special case is the XInclude support, but this requires an explicit processing call, making fpdf2 not vulnerable to this attack as well: https://docs.python.org/3/library/xml.etree.elementtree.html#xinclude-support

Is the dependency still required here?

[rs3c1]

I would think 10 times before removing it... Recently was researching for vulnerabilities and this stoped me to move from BLIND SSRF to RCE.

[stefan6419846]

Could you please elaborate on what actually remains an issue in this regard? defusedxml will still rely on Expat in the background, just setting some further defaults which are not strictly necessary as far as I understand and as far as I can see from running the current test suite with defusedxml replaced by their stdlib counterparts.