Mitigate XML Vulnerabilities

[John-P]

I noticed that lxml is being used to parse the XML box. A maliciously crafted XML box could be vulnerable to typical XML attacks such as quadratic blowup or entity expansion (see https://pypi.org/project/defusedxml/#python-xml-libraries). Would it be prudent to go through the example guidance in defusedxml to verify that the setup is safe?

I would be happy to give this a go and open a PR if that would be helpful.

[quintusdias]

Possibly... But in looking this over, I see something in XMLBox that I really wish I'd done differently, so I'm going to address that first (non-breaking change), then I'll get back to this.