Add message about scoping shared mailboxes when using MSGraph ClientSecret auth (#322)

* Add message about scoping to shared mailboxes

* disable resolve entities in Xml Parser

README.rst

@@ -237,6 +237,7 @@ The full set of configuration options are:
         If you are using the `ClientSecret` auth method, you need to grant the ``Mail.ReadWrite`` (application) permission to the app.
         You must also restrict the application's access to a specific mailbox since it allows all mailboxes by default.
         Use the ``New-ApplicationAccessPolicy`` command in the Exchange PowerShell module.
+        If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.
 
         ``New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>" -Description "Restrict access to dmarc reports mailbox."``
 

docs/index.rst

@@ -232,6 +232,7 @@ The full set of configuration options are:
         If you are using the `ClientSecret` auth method, you need to grant the ``Mail.ReadWrite`` (application) permission to the app.
         You must also restrict the application's access to a specific mailbox since it allows all mailboxes by default.
         Use the ``New-ApplicationAccessPolicy`` command in the Exchange PowerShell module.
+        If you need to scope the policy to shared mailboxes, you can add them to a mail enabled security group and use that as the group id.
 
         ``New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "<CLIENT_ID>" -PolicyScopeGroupId "<MAILBOX>" -Description "Restrict access to dmarc reports mailbox."``
 

parsedmarc/__init__.py

@@ -230,8 +230,9 @@ def parse_aggregate_report_xml(xml, ip_db_path=None, offline=False,
         xmltodict.parse(xml)["feedback"]
     except Exception as e:
         errors.append("Invalid XML: {0}".format(e.__str__()))
-        tree = etree.parse(BytesIO(xml.encode('utf-8')),
-                           etree.XMLParser(recover=True))
+        tree = etree.parse(
+            BytesIO(xml.encode('utf-8')),
+            etree.XMLParser(recover=True, resolve_entities=False))
         s = etree.tostring(tree)
         xml = '' if s is None else s.decode('utf-8')