Potential fix for code scanning alert no. 32: XML external entity expansion

[crisrss]

Potential fix for https://github.com/SolidifyDemo/ghas-vulnerable-python-template/security/code-scanning/32

In general, to fix XXE vulnerabilities you must ensure that XML parsers used on untrusted input cannot resolve external entities. With Python’s SAX/DOM stack, this means disabling the external entity features on the parser (or using a hardened library like defusedxml) and avoiding any API that performs arbitrary entity expansion.

For this specific function, the safest minimal fix while keeping existing behavior (extracting the text of the <text> element and storing it in the database) is:

• Stop enabling feature_external_ges; instead, explicitly disable it.
• Avoid using doc.expandNode(node), which attempts to expand entity references.
• Still iterate over events and capture the text content of the <text> element, but without expanding entities. Since this view appears to be a lab, we keep the general structure and return value intact.

Concretely, in introduction/views.py:

• In xxe_parse, change parser.setFeature(feature_external_ges, True) to parser.setFeature(feature_external_ges, False).
• Remove the call to doc.expandNode(node) and the manual toxml() plus substring slicing. Instead, build the element’s text by joining its text node children.

These changes require no new imports and keep the stored comment equal to the literal text content between <text> and </text> in the user’s XML.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.