docs: clarify stdlib xml vs defusedxml usage at every import site

pyproject.toml

@@ -13,7 +13,7 @@ license-files = ["LICENSE"]
 readme = "README.md"
 
 dependencies = [
-    'defusedxml>=0.7.1',  # latest as at 7/31/23
+    'defusedxml>=0.7.1',  # latest as at 7/31/23; use for all XML parsing — stdlib xml is unsafe against XXE. XML building (Element/SubElement/tostring) still uses stdlib as defusedxml has no equivalents.
     'packaging>=23.1',   # latest as at 7/31/23
     'requests>=2.32',  # latest as at 7/31/23
     'urllib3>=2.6.0,<3',

tableauserverclient/models/collection_item.py

@@ -1,5 +1,5 @@
 from datetime import datetime
-from xml.etree.ElementTree import Element
+from xml.etree.ElementTree import Element  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 from typing_extensions import Self

tableauserverclient/models/data_freshness_policy_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from tableauserverclient.models.property_decorators import property_is_enum, property_not_nullable
 from .interval_item import IntervalItem

tableauserverclient/models/datasource_item.py

@@ -1,6 +1,6 @@
 import copy
 import datetime
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/extract_item.py

@@ -1,5 +1,5 @@
 from defusedxml.ElementTree import fromstring
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 
 class ExtractItem:

tableauserverclient/models/flow_item.py

@@ -1,7 +1,7 @@
 from collections.abc import Iterable
 import copy
 import datetime
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/groupset_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 from typing_extensions import Self

tableauserverclient/models/location_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 
 class LocationItem:

tableauserverclient/models/metric_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from datetime import datetime
 
 from tableauserverclient.datetime_helpers import parse_datetime

tableauserverclient/models/permissions_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/project_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from typing import overload
 
 from defusedxml.ElementTree import fromstring

tableauserverclient/models/schedule_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from datetime import datetime
 from typing import TYPE_CHECKING
 

tableauserverclient/models/server_info_item.py

@@ -1,6 +1,6 @@
 import logging
 import warnings
-import xml
+import xml  # for xml.etree.ElementTree.ParseError exception type only; defusedxml raises this same class
 
 from defusedxml.ElementTree import fromstring
 from tableauserverclient.helpers.logging import logger

tableauserverclient/models/site_item.py

@@ -1,5 +1,5 @@
 import warnings
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/tag_item.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/user_item.py

@@ -1,5 +1,5 @@
 import io
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from datetime import datetime
 from enum import IntEnum
 from typing import TYPE_CHECKING

tableauserverclient/models/virtual_connection_item.py

@@ -2,7 +2,7 @@
 import json
 from typing import Callable
 from collections.abc import Iterable
-from xml.etree.ElementTree import Element
+from xml.etree.ElementTree import Element  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/webhook_item.py

@@ -1,5 +1,5 @@
 import re
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 
 from defusedxml.ElementTree import fromstring
 

tableauserverclient/models/workbook_item.py

@@ -1,7 +1,7 @@
 import copy
 import datetime
 import uuid
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from typing import Callable, overload
 
 from defusedxml.ElementTree import fromstring

tableauserverclient/server/endpoint/endpoint.py

@@ -8,7 +8,7 @@
 import abc
 from packaging.version import Version
 from functools import wraps
-from xml.etree.ElementTree import ParseError
+from xml.etree.ElementTree import ParseError  # exception type only; defusedxml raises this same class
 from typing import (
     Any,
     Callable,

tableauserverclient/server/request_factory.py

@@ -1,4 +1,4 @@
-import xml.etree.ElementTree as ET
+import xml.etree.ElementTree as ET  # building XML request bodies only; use defusedxml for parsing
 from typing import Any, Callable, TypeVar, TYPE_CHECKING
 from collections.abc import Iterable