No longer using defusedxml since it is not necessary.

[ghost]

Closes #956
Closes #1014

It is not necessary to use defused when using the lxml parser. The package defusedxml.lxml is deprecated because of this.

The lxml parser uses libxml2 that has the guards against the vulnerabilities build in (at least libxml2 > 2.6). Since zeep already uses the lxml parser, this pull request removes defusedxml as a dependency. Some functionality regarding forbid_dtd and forbid_entities that were present in defusedxml is now present in loader.py and exceptions were added to zeep with the same name as in defusedxml.

• dependency on defusedxml removed
• added two new exception classes DTDForbidden en EntitiesForbidden
• when loading a document the docinfo is checked for entities and doctype.

[ghost]

Zie blurb on https://github.com/tiran/defusedxml/blob/master/defusedxml/lxml.py for an explanation:

"""DEPRECATED Example code for lxml.etree protection
The code has NO protection against decompression bombs.
"""

[Yanonix]

Have you an estimate date for a new release with this pull request ?
Thanks

[ghost]

I do not know, I haven't had any feedback on this PR from the owner. The repository seems very quiet.

[mvantellingen]

Looks good, thanks! This was on my todo list for a while