From d102aca17572119ad29c1494e08eac7508098d8f Mon Sep 17 00:00:00 2001
From: Kovid Goyal <kovid@kovidgoyal.net>
Date: Sun, 29 Dec 2019 18:17:20 +0530
Subject: [PATCH] Dont resolve entities in the RECOVER_PARSER

---
 src/calibre/ebooks/docx/container.py  | 3 +--
 src/calibre/ebooks/oeb/parse_utils.py | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/calibre/ebooks/docx/container.py b/src/calibre/ebooks/docx/container.py
index 6dd89f3eea..7bd6768a8f 100644
--- a/src/calibre/ebooks/docx/container.py
+++ b/src/calibre/ebooks/docx/container.py
@@ -19,10 +19,9 @@ from calibre.utils.localization import canonicalize_lang
 from calibre.utils.logging import default_log
 from calibre.utils.zipfile import ZipFile
 from calibre.utils.xml_parse import safe_xml_fromstring
-from calibre.ebooks.oeb.parse_utils import RECOVER_PARSER
 
 
-def fromstring(raw, parser=RECOVER_PARSER):
+def fromstring(raw, parser=None):
     return safe_xml_fromstring(raw)
 
 # Read metadata {{{
diff --git a/src/calibre/ebooks/oeb/parse_utils.py b/src/calibre/ebooks/oeb/parse_utils.py
index 224c950678..427b47f168 100644
--- a/src/calibre/ebooks/oeb/parse_utils.py
+++ b/src/calibre/ebooks/oeb/parse_utils.py
@@ -16,7 +16,7 @@ from calibre.constants import filesystem_encoding
 from calibre.ebooks.chardet import xml_to_unicode, strip_encoding_declarations
 from polyglot.builtins import iteritems, itervalues, unicode_type, string_or_bytes, map
 
-RECOVER_PARSER = etree.XMLParser(recover=True, no_network=True)
+RECOVER_PARSER = etree.XMLParser(recover=True, no_network=True, resolve_entities=False)
 XHTML_NS     = 'http://www.w3.org/1999/xhtml'
 XMLNS_NS     = 'http://www.w3.org/2000/xmlns/'