title: XML injections in Python using xml.dom.minidom
body: <p>I scanned Python source code using <a href="https://www.ibm.com/security/application-security/appscan" rel="nofollow noreferrer">AppScan</a> and it says that the code contains potential vulnerabilities (XML Injection). For example:</p>
  
  <pre><code>import xml.dom.minidom
  
  ...
  dom = xml.dom.minidom.parse(filename)
  ...
  document = xml.dom.minidom.parseString(xmlStr)
  ...
  </code></pre>
  
  <p>I installed the defusedxml and replaced all parsings where use the standard Python xml package with parse/parseString from defusedxml.minidom &amp; defusedxml.cElementTree:</p>
  
  <pre><code>import defusedxml.minidom
  
  ...
  dom = defusedxml.minidom.parse(filename)
  ...
  document = defusedxml.minidom.parseString(xmlStr)
  ...
  </code></pre>
  
  <p>These vulnerabilities are gone from scan report. But AppScan still notify me about vulnerabilities where from standard xml package are importing any functions/classes. For example classes from ElementTree to modify/build xml tree:</p>
  
  <pre><code>from xml.etree.cElementTree import (  # vulnerability here
  SubElement, Element, ElementTree)
  import defusedxml.cElementTree as et
  ...
  template = et.parse(template_filename)  # safe parsing
  
  root = template.getroot()
  email_list_el = root.find('emails').find('list')
  
  for email_address in to_list:
      SubElement(email_list_el , 'string').text = email_address 
      root.find('subject')[0].text = subject
      root.find('body')[0].text = body
  ...
  </code></pre>
  
  <p>Can this be considered a vulnerability if xml.dom.minidom is used only for writing XML?</p>