title: Fortify XML Injection issue in Python
body: <p>I have a very small snippet of HTML to create in my Python application and use ElementTree to create it. When scanning my application, Fortify detects an XML Injection vulnerability in the following code</p>
  <pre><code>from xml.etree.ElementTree import Element, SubElement
  
  html = Element('html')
  head = SubElement(html, 'head')
  </code></pre>
  <p>I tried to escape the text using</p>
  <pre><code>from xml.etree.ElementTree import Element, SubElement
  from xml.sax.saxutils import escape
  
  html = Element(escape('html'))
  head = SubElement(html, escape('head'))
  </code></pre>
  <p>but Fortify still still detects a vulnerability. How can I rewrite this code so that Fortify doesn't complain?</p>