0.5.0 re-impl of #921

Author: CalebCourier

guardrails/classes/templating/constants_container.py

@@ -17,7 +17,7 @@ def fill_constants(self) -> None:
         with open(constants_file, "r") as f:
             xml = f.read()
 
-        parser = ET.XMLParser(encoding="utf-8")
+        parser = ET.XMLParser(encoding="utf-8", resolve_entities=False)
         parsed_constants = ET.fromstring(xml, parser=parser)
 
         for child in parsed_constants:

guardrails/schema/rail_schema.py

@@ -350,7 +350,7 @@ def rail_string_to_schema(rail_string: str) -> ProcessedSchema:
         validators=[], validator_map={}, exec_opts=GuardExecutionOptions()
     )
 
-    XMLPARSER = XMLParser(encoding="utf-8")
+    XMLPARSER = XMLParser(encoding="utf-8", resolve_entities=False)
     rail_xml: _Element = ET.fromstring(rail_string, parser=XMLPARSER)
 
     # Load <output /> schema