Merge pull request #233 from edx/TNL-8593/security-fix

fix: update lxml parser for celery tasks to be more secure

cms/celery.py

@@ -5,9 +5,13 @@ and auto discover tasks in all installed django apps.
 Taken from: https://celery.readthedocs.org/en/latest/django/first-steps-with-django.html
 """
 
-
 import os
 
+# Patch the xml libs before anything else.
+from safe_lxml import defuse_xml_libs
+
+defuse_xml_libs()
+
 
 # Set the default Django settings module for the 'celery' program
 # and then instantiate the Celery singleton.

lms/celery.py

@@ -7,6 +7,11 @@ Taken from: https://celery.readthedocs.org/en/latest/django/first-steps-with-dja
 
 import os
 
+# Patch the xml libs before anything else.
+from safe_lxml import defuse_xml_libs
+
+defuse_xml_libs()
+
 
 # Set the default Django settings module for the 'celery' program
 # and then instantiate the Celery singleton.