Prevent XXE in epub/fb2/goodreads API

The lxml.etree.fromstring() function use the default XML parser, which resolves
external entities because XML handling defaults in Python sucks. There is no
need for such dangerous misfeatures in calibre-web, so let's disable it.

A user able to upload epub/fb2 could add something like this to the file:

```xml
<?xml version="1.0"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<container><rootfiles><rootfile full-path="&xxe;"/></rootfiles></container>
```

and obtain the content of the `/etc/passwd` file, which is bad™.

cps/epub_helper.py

@@ -53,16 +53,20 @@ def updateEpub(src, dest, filename, data, ):
         zf.writestr(filename, data)
 
 
+# Safe parser: disable entity resolution and network access to prevent XXE attacks
+_safe_parser = etree.XMLParser(resolve_entities=False, no_network=True)
+
+
 def get_content_opf(file_path, ns=None):
     if ns is None:
         ns = default_ns
     epubZip = zipfile.ZipFile(file_path)
     txt = epubZip.read('META-INF/container.xml')
-    tree = etree.fromstring(txt)
+    tree = etree.fromstring(txt, parser=_safe_parser)
     cf_name = tree.xpath('n:rootfiles/n:rootfile/@full-path', namespaces=ns)[0]
     cf = epubZip.read(cf_name)
 
-    return etree.fromstring(cf), cf_name
+    return etree.fromstring(cf, parser=_safe_parser), cf_name
 
 
 def create_new_metadata_backup(book,  custom_columns, export_language, translated_cover_name, lang_type=3):