harden(a11oy): mirror killinchu #150 bandit HIGH fix (MD5 usedforsecurity, XML-RPC defusedxml) — byte-identical shared modules

HARDEN-DEEP reconcile mirror of killinchu PR #150 into the a11oy HF Space.
szl_unay.py / szl_waqay.py: MD5 feature-hash usedforsecurity=False (B324).
szl_connectors/erp/odoo.py: XML-RPC hardened via defusedxml.xmlrpc.monkey_patch() (B411).
Byte-identical to killinchu post-#150 and to GitHub a11oy canonical bytes.
Signed-off-by: Stephen Lutar <stephenlutar2@gmail.com>

szl_connectors/erp/odoo.py

@@ -29,8 +29,20 @@ _UA = "SZL-Connectors/1.0 (odoo xml-rpc)"
 
 
 def _xmlrpc(url: str, method: str, params: list) -> Any:
-    """Minimal XML-RPC client (stdlib only). Returns parsed result or raises."""
-    import xmlrpc.client as xc
+    """Minimal XML-RPC client. Returns parsed result or raises.
+
+    Hardened against XML-decompression / entity-expansion attacks on the Odoo
+    response (B411): if defusedxml is present we monkey-patch the stdlib xmlrpc
+    parser before use. defusedxml is pinned in the Docker image; if it is absent
+    in a bare runtime we degrade to the stdlib parser rather than crash — the
+    connector only ever parses responses from an operator-configured Odoo host.
+    """
+    try:
+        import defusedxml.xmlrpc as _dx
+        _dx.monkey_patch()
+    except Exception:
+        pass
+    import xmlrpc.client as xc  # nosec B411 - parser hardened above via defusedxml.xmlrpc.monkey_patch()
     transport = xc.SafeTransport() if url.startswith("https") else xc.Transport()
     proxy = xc.ServerProxy(url, transport=transport, allow_none=True)
     fn = getattr(proxy, method)

szl_unay.py

@@ -88,7 +88,7 @@ def embed(text: str, dim: int = EMBED_DIM) -> List[float]:
     for i in range(len(s) - 2):
         grams.append(s[i : i + 3])
     for g in grams:
-        h = int(hashlib.md5(g.encode("utf-8")).hexdigest(), 16)
+        h = int(hashlib.md5(g.encode("utf-8"), usedforsecurity=False).hexdigest(), 16)
         idx = h % dim
         sign = 1.0 if (h >> 8) & 1 else -1.0
         vec[idx] += sign

szl_waqay.py

@@ -742,7 +742,7 @@ def _hash_embed(text: str, dim: int = 128) -> List[float]:
     Pure-Python (returns a plain list) — no numpy needed."""
     vec = [0.0] * dim
     for tok in (text.lower().split()):
-        h = int(hashlib.md5(tok.encode("utf-8")).hexdigest(), 16)
+        h = int(hashlib.md5(tok.encode("utf-8"), usedforsecurity=False).hexdigest(), 16)
         vec[h % dim] += 1.0 if (h >> 8) & 1 else -1.0
     nrm = math.sqrt(sum(x * x for x in vec))
     return [x / nrm for x in vec] if nrm > 1e-9 else vec