switch to safe XML parsing

Author: Teque5

pyproject.toml

@@ -24,6 +24,7 @@ requires-python = ">=3.7"
 dependencies = [
     "numpy",        # for vector math
     "jsonschema",   # for spec validation
+    "defusedxml",   # for safe XML parsing (XXE protection)
 ]
     [project.urls]
     repository = "https://github.com/sigmf/sigmf-python"

sigmf/convert/signalhound.py

@@ -10,7 +10,7 @@
 import io
 import logging
 import tempfile
-import xml.etree.ElementTree as ET
+import defusedxml.ElementTree as ET
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import List, Optional, Tuple