From e54abadc777715b6dcb545c13214d1dea63df6c9 Mon Sep 17 00:00:00 2001
From: DefineFC <920301655@qq.com>
Date: Wed, 4 Jul 2018 11:58:08 +0800
Subject: [PATCH] =?UTF-8?q?=E5=AE=89=E5=85=A8=E4=BF=AE=E5=A4=8D=EF=BC=9A?=
 =?UTF-8?q?=E9=98=B2=E8=8C=83XML=E5=A4=96=E9=83=A8=E5=AE=9E=E4=BD=93?=
 =?UTF-8?q?=E6=B3=A8=E5=85=A5=E6=BC=8F=E6=B4=9E=EF=BC=88XXE=EF=BC=89=20?=
 =?UTF-8?q?=E5=8F=82=E8=80=83=EF=BC=9Ahttps://pay.weixin.qq.com/wiki/doc/a?=
 =?UTF-8?q?pi/jsapi.php=3Fchapter=3D23=5F5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 weixin/msg.py | 3 ++-
 weixin/pay.py | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/weixin/msg.py b/weixin/msg.py
index cb4e74a..89806b0 100644
--- a/weixin/msg.py
+++ b/weixin/msg.py
@@ -64,7 +64,8 @@ def validate(self, signature, timestamp, nonce):
 
     def parse(self, content):
         raw = {}
-        root = etree.fromstring(content)
+        root = etree.fromstring(content,
+                                parser=etree.XMLParser(resolve_entities=False))
         for child in root:
             raw[child.tag] = child.text
 
diff --git a/weixin/pay.py b/weixin/pay.py
index 4ab8cfb..1f8e231 100644
--- a/weixin/pay.py
+++ b/weixin/pay.py
@@ -79,7 +79,8 @@ def to_xml(self, raw):
 
     def to_dict(self, content):
         raw = {}
-        root = etree.fromstring(content.encode("utf-8"))
+        root = etree.fromstring(content.encode("utf-8"),
+                                parser=etree.XMLParser(resolve_entities=False))
         for child in root:
             raw[child.tag] = child.text
         return raw