Repository: SAML-Toolkits/python3-saml (language: python)

Issue:
lxml has a vulnerability but we can not update because of python3-saml relies on <4.7.1
Hi all.

As I mentioned in the subject of the issue, what I wanted to achieve is to update lxml to the first safe version which is the 4.9.1 but Poetry slams the door telling me I can not do it, and with valid reasons:

```
 SolverProblemError

  Because python3-saml (1.14.0) depends on lxml (<4.7.1)
   and no versions of python3-saml match >1.14.0,<1.15.0, python3-saml (>=1.14.0,<1.15.0) requires lxml (<4.7.1).
  So, because atoka-revenge depends on both lxml (^4.9.1) and python3-saml (~1.14.0), version solving failed.
```

Security output.

```
| lxml    | CVE-2022-2309    |          | 4.7.0             | 4.9.1         | lxml: NULL Pointer                    |
|         |                  |          |                   |               | Dereference in lxml                   |
|         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-2309  |
```

Am I missing something or do somebody have a suggestion on this, pretty please?

Thank you for considering my request.


Discussion / hints:

Fix patch:
diff --git a/README.md b/README.md
index 08f15fde..9367178c 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,7 @@ Installation
 
  * python 2.7 // python 3.6
  * [xmlsec](https://pypi.python.org/pypi/xmlsec) Python bindings for the XML Security Library.
+ * [lxml](https://pypi.python.org/pypi/lxml) Python bindings for the libxml2 and libxslt libraries.
  * [isodate](https://pypi.python.org/pypi/isodate) An ISO 8601 date/time/
  duration parser and formatter
 
@@ -115,6 +116,14 @@ $ pip install python3-saml
 
 If you want to know how a project can handle python packages review this [guide](https://packaging.python.org/en/latest/tutorial.html) and review this [sampleproject](https://github.com/pypa/sampleproject)
 
+#### NOTE ####
+To avoid ``libxml2`` library version incompatibilities between ``xmlsec`` and ``lxml`` it is recommended that ``lxml`` is not installed from binary.
+
+This can be ensured by executing:
+```
+$ pip install --force-reinstall --no-binary lxml lxml
+```
+
 Security Warning
 ----------------
 
diff --git a/setup.py b/setup.py
index 8e0b7355..eedf9671 100644
--- a/setup.py
+++ b/setup.py
@@ -34,7 +34,7 @@
     },
     test_suite='tests',
     install_requires=[
-        'lxml<4.7.1',
+        'lxml>=4.6.5',
         'isodate>=0.6.1',
         'xmlsec>=1.3.9'
     ],


Test patch:
diff --git a/tests/src/OneLogin/saml2_tests/xml_utils_test.py b/tests/src/OneLogin/saml2_tests/xml_utils_test.py
index 45a57452..bc563621 100644
--- a/tests/src/OneLogin/saml2_tests/xml_utils_test.py
+++ b/tests/src/OneLogin/saml2_tests/xml_utils_test.py
@@ -3,6 +3,7 @@
 
 import json
 import unittest
+import xmlsec
 
 from base64 import b64decode
 from lxml import etree
@@ -32,6 +33,29 @@ def file_contents(self, filename):
         f.close()
         return content
 
+    def testLibxml2(self):
+        """
+        Tests that libxml2 versions used by xmlsec and lxml are compatible
+
+        If this test fails, reinstall lxml without using binary to ensure it is
+        linked to same version of libxml2 as xmlsec:
+        pip install --force-reinstall --no-binary lxml lxml
+
+        See https://bugs.launchpad.net/lxml/+bug/1960668
+        """
+        env = etree.fromstring('<xml></xml>')
+        sig = xmlsec.template.create(
+            env,
+            xmlsec.Transform.EXCL_C14N,
+            xmlsec.Transform.RSA_SHA256,
+            ns="ds"
+        )
+
+        ds = etree.QName(sig).namespace
+        cm = sig.find(".//{%s}CanonicalizationMethod" % ds)
+
+        self.assertIsNotNone(cm)
+
     def testValidateXML(self):
         """
         Tests the validate_xml method of the OneLogin_Saml2_XML