Безопасность: замена xml.etree.ElementTree на defusedxml (защита от XXE-инъекций)

requirements.txt

@@ -1,3 +1,4 @@
 discord.py>=2.3.2
 python-dotenv>=1.0.0
 requests>=2.31.0
+defusedxml>=7.0.0

utils/news.py

@@ -17,12 +17,12 @@ _session = requests.Session()
 async def fetch_rss(url):
     """Скачать и распарсить RSS-ленту (RSS 2.0 / Atom)."""
     await habr_rss_limiter.acquire()
-    from xml.etree import ElementTree
+    from defusedxml.ElementTree import fromstring
 
     try:
         response = await asyncio.to_thread(_session.get, url, timeout=10)
         response.raise_for_status()
-        root = ElementTree.fromstring(response.content)
+        root = fromstring(response.content)
 
         # RSS 2.0
         ns_dc = {"dc": "http://purl.org/dc/elements/1.1/"}