XML External Entity
Objects that parse or handle XML data can lead to XML External Entity (XXE) attacks when not configured properly. Improper restriction of XML external entity processing can lead to server-side request forgery and information disclosure.
def xml_parse_noncompliant():
    from lxml import etree
    # Noncompliant: resolve_entities is not disabled
    # and is set to true by default.
    parser = etree.XMLParser()
    tree1 = etree.parse('resources/xxe.xml', parser)
def xml_parse_compliant():
    from lxml import etree
    # Compliant: resolve_entities is disabled.
    parser = etree.XMLParser(resolve_entities=False)
    tree1 = etree.parse('resources/xxe.xml', parser)