Merge pull request openedx#28442 from edx/saad/backport-TNL-8593-cele…

…ry-xxe-fix-lilac

fix: update lxml parser for celery tasks to be more secure
(cherry picked from commit 809ed34)

cms/celery.py

@@ -5,9 +5,13 @@
 Taken from: https://celery.readthedocs.org/en/latest/django/first-steps-with-django.html
 """
 
-
 import os
 
+# Patch the xml libs before anything else.
+from safe_lxml import defuse_xml_libs
+
+defuse_xml_libs()
+
 
 # Set the default Django settings module for the 'celery' program
 # and then instantiate the Celery singleton.

lms/celery.py

@@ -7,6 +7,11 @@
 
 import os
 
+# Patch the xml libs before anything else.
+from safe_lxml import defuse_xml_libs
+
+defuse_xml_libs()
+
 
 # Set the default Django settings module for the 'celery' program
 # and then instantiate the Celery singleton.