From 5a2f1630f6a1d96c403aaa8d8401e76fc4bbe93f Mon Sep 17 00:00:00 2001
From: deadzilla <zalnikov@gmail.com>
Date: Tue, 7 Jul 2026 22:46:02 +0500
Subject: [PATCH] =?UTF-8?q?=D0=91=D0=B5=D0=B7=D0=BE=D0=BF=D0=B0=D1=81?=
 =?UTF-8?q?=D0=BD=D0=BE=D1=81=D1=82=D1=8C:=20=D0=B7=D0=B0=D0=BC=D0=B5?=
 =?UTF-8?q?=D0=BD=D0=B0=20xml.etree.ElementTree=20=D0=BD=D0=B0=20defusedxm?=
 =?UTF-8?q?l=20(=D0=B7=D0=B0=D1=89=D0=B8=D1=82=D0=B0=20=D0=BE=D1=82=20XXE-?=
 =?UTF-8?q?=D0=B8=D0=BD=D1=8A=D0=B5=D0=BA=D1=86=D0=B8=D0=B9)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 requirements.txt | 1 +
 utils/news.py    | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index 63c5877..3b4417e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,4 @@
 discord.py>=2.3.2
 python-dotenv>=1.0.0
 requests>=2.31.0
+defusedxml>=7.0.0
diff --git a/utils/news.py b/utils/news.py
index b7d2f02..75665f5 100644
--- a/utils/news.py
+++ b/utils/news.py
@@ -17,12 +17,12 @@ _session = requests.Session()
 async def fetch_rss(url):
     """Скачать и распарсить RSS-ленту (RSS 2.0 / Atom)."""
     await habr_rss_limiter.acquire()
-    from xml.etree import ElementTree
+    from defusedxml.ElementTree import fromstring
 
     try:
         response = await asyncio.to_thread(_session.get, url, timeout=10)
         response.raise_for_status()
-        root = ElementTree.fromstring(response.content)
+        root = fromstring(response.content)
 
         # RSS 2.0
         ns_dc = {"dc": "http://purl.org/dc/elements/1.1/"}