fix: [import_mod/lib] use defusedxml for GoAML and ODT parsing

[elhoim]

The defect

Both goamlimport.py and odtreader.py parse attacker-supplied XML with the standard library's xml.etree.ElementTree, which is not hardened against XML entity-expansion attacks:

# misp_modules/modules/import_mod/goamlimport.py:251
self.tree = ET.fromstring(data)

# misp_modules/lib/ODTReader/odtreader.py:31
root = ET.fromstring(odtContent)

xml.etree.ElementTree.fromstring will happily expand nested internal entities (e.g. "billion laughs") or resolve external entities, so a crafted GoAML report or a crafted content.xml inside an .odt file can exhaust memory/CPU on the misp-modules worker.

Impact

A MISP user importing a malicious GoAML report or a malicious .odt file (both are user-supplied import inputs) can cause a denial-of-service against the misp-modules server process handling the import — no authentication beyond "can submit an import" is required.

Fix

Swap the import to defusedxml.ElementTree, which rejects entity expansion and external entity resolution while preserving the same fromstring API used at both call sites (ET.fromstring only — no other ET.* attributes are used in either file, so this is a drop-in replacement here). No behaviour change for well-formed, non-malicious input.

defusedxml (0.7.1) is already present in poetry.lock as a transitive dependency of sigmf, so no new dependency is introduced by this change — only the import is swapped. It is not currently declared as a direct dependency in pyproject.toml; maintainers may want to promote it to a direct dependency now that the code relies on it explicitly rather than transitively.

Verification

• flake8 clean on goamlimport.py; py_compile clean on odtreader.py.
• Full module test suite: 161 passed, 4 skipped, 5 subtests passed in 24.63s.
• Confirmed both files use only ET.fromstring (grep -n 'ET\.' ...), which defusedxml.ElementTree supports directly.

Found during a review of the repository; other findings are being submitted as separate PRs.

🤖 Generated with Claude Code

https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8