From 1932722277a207de8f506af0af9dfb72af4cba3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Chaves?= <adrian@chaves.io>
Date: Thu, 29 Feb 2024 09:50:29 +0100
Subject: [PATCH] Use defusedxml.xmlrpc

---
 scrapy/http/request/rpc.py | 4 ++++
 setup.py                   | 1 +
 2 files changed, 5 insertions(+)

diff --git a/scrapy/http/request/rpc.py b/scrapy/http/request/rpc.py
index 43692923b..59767de7a 100644
--- a/scrapy/http/request/rpc.py
+++ b/scrapy/http/request/rpc.py
@@ -7,9 +7,13 @@ See documentation in docs/topics/request-response.rst
 import xmlrpc.client as xmlrpclib
 from typing import Optional
 
+import defusedxml.xmlrpc
+
 from scrapy.http.request import Request
 from scrapy.utils.python import get_func_args
 
+defusedxml.xmlrpc.monkey_patch()
+
 DUMPS_ARGS = get_func_args(xmlrpclib.dumps)
 
 
diff --git a/setup.py b/setup.py
index 405633f55..2d6d26b0c 100644
--- a/setup.py
+++ b/setup.py
@@ -22,6 +22,7 @@ install_requires = [
     "packaging",
     "tldextract",
     "lxml>=4.4.1",
+    "defusedxml>=0.7.1",
 ]
 extras_require = {
     ':platform_python_implementation == "CPython"': ["PyDispatcher>=2.0.5"],