fix(ops): Atom 解析改用 defusedxml（bandit B314）

上游状态页的 DeepSeek 解析器用 stdlib `ElementTree.fromstring` 读外部 Atom，
对「十亿笑声 / 实体展开」这类 XXE / DoS 载荷不设防，CI security job 的
bandit 报 B314（Medium）。

- 解析入口换成 `defusedxml.ElementTree.fromstring`（bandit 官方推荐的修法，
  比逐处 `# nosec` 或全局 skip B314 更稳：保留规则对新增解析点的保护）
- Element 类型仍复用 stdlib（defusedxml 只是换了安全解析入口）
- 新增用例：XXE 外部实体与十亿笑声载荷都必须抛 ValueError → 由 fetch_source
  兜成 unknown 条目，不让外部站点读到本地文件或炸内存

pyproject 新增 defusedxml>=0.7.1（纯 Python，约 25KB）。

Author: RobbsLuo

pyproject.toml

@@ -6,6 +6,7 @@ readme = "README.md"
 requires-python = ">=3.12"
 dependencies = [
     "cryptography>=44",
+    "defusedxml>=0.7.1",
     "fastapi>=0.115",
     "httpx[socks]>=0.28",
     "itsdangerous>=2.2",

src/upstream_status.py

@@ -32,14 +32,21 @@
 import html
 import re
 import time
-import xml.etree.ElementTree as ElementTree
 from collections.abc import Iterable
 from dataclasses import dataclass
 from datetime import datetime
 from typing import Any, Literal
 
+#: defusedxml 复用 stdlib 的 Element 类型（只是把解析入口换成安全版）。
+from xml.etree.ElementTree import Element as XmlElement
+
 import httpx
 
+# Atom 事故史来自外部站点：用 defusedxml 而非 stdlib ElementTree——后者对
+# 「十亿笑声 / 实体展开」这类 XXE / DoS 载荷不设防（bandit B314）。
+from defusedxml.ElementTree import ParseError as XmlParseError
+from defusedxml.ElementTree import fromstring as xml_fromstring
+
 # ------------------------------------------------------------------ 健康档位
 
 LEVEL_OPERATIONAL = "operational"
@@ -508,8 +515,8 @@ def parse_atom(spec: SourceSpec, text: Any, *, now: int) -> SourceStatus:
     if not isinstance(text, str):
         raise ValueError("atom payload is not text")
     try:
-        root = ElementTree.fromstring(text)
-    except ElementTree.ParseError as error:
+        root = xml_fromstring(text)
+    except XmlParseError as error:
         raise ValueError(f"atom payload is not valid XML: {error}") from error
 
     incidents: list[Incident] = []
@@ -581,22 +588,22 @@ def _deepseek_title_level(title: str) -> str:
 _ATOM_NS = "http://www.w3.org/2005/Atom"
 
 
-def _atom_children(root: ElementTree.Element, name: str) -> list[ElementTree.Element]:
+def _atom_children(root: XmlElement, name: str) -> list[XmlElement]:
     """按 Atom 命名空间找子元素；无命名空间的裸 `<entry>` 也认（上游换库不崩）。"""
     found = root.findall(f"{{{_ATOM_NS}}}{name}")
     if found:
         return found
     return [child for child in root if child.tag.split("}")[-1] == name]
 
 
-def _atom_text(entry: ElementTree.Element, name: str) -> str | None:
+def _atom_text(entry: XmlElement, name: str) -> str | None:
     children = _atom_children(entry, name)
     if not children:
         return None
     return _text("".join(children[0].itertext())) or None
 
 
-def _atom_link(entry: ElementTree.Element) -> str | None:
+def _atom_link(entry: XmlElement) -> str | None:
     for child in _atom_children(entry, "link"):
         href = child.get("href")
         if href:

tests/test_upstream_status.py

@@ -493,6 +493,23 @@ def test_parse_atom_rejects_bad_input():
         parse_atom(_spec("deepseek"), "<feed><entry>", now=NOW)
 
 
+def test_parse_atom_rejects_xxe_and_entity_expansion():
+    """外部实体 / 十亿笑声：走 defusedxml，绝不能让外部站点读本地文件或炸内存。
+
+    stdlib `ElementTree.fromstring` 对这两类载荷不设防（bandit B314），故解析
+    入口用 defusedxml——命中即抛 `ValueError`，由 `fetch_source` 兜成 unknown。
+    """
+    xxe = ('<?xml version="1.0"?><!DOCTYPE feed [<!ENTITY xxe SYSTEM '
+           '"file:///etc/passwd">]><feed><entry><title>&xxe;</title></entry></feed>')
+    with pytest.raises(ValueError):
+        parse_atom(_spec("deepseek"), xxe, now=NOW)
+    billion_laughs = ('<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol">'
+                      '<!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;">]>'
+                      '<feed><entry><title>&lol2;</title></entry></feed>')
+    with pytest.raises(ValueError):
+        parse_atom(_spec("deepseek"), billion_laughs, now=NOW)
+
+
 def test_parse_atom_tolerates_unrelated_entries_and_missing_link():
     """无 link 的条目 url 为 None；summary 为空文本时 detail 为 None。"""
     feed = ("<feed><entry><title>性能下降</title><summary>  </summary></entry>"