From what I can tell, it is very well known in security circles.
Even so, we as a team of 8 didn't catch the problem for some time because we weren't aware of it. That's part of my rational for giving an easy-to-test-yourself POC.
Even so, we as a team of 8 didn't catch the problem for some time because we weren't aware of it. That's part of my rational for giving an easy-to-test-yourself POC.
It has a module which "acts as an example how you could protect code that uses lxml.etree. It implements a custom Element class that filters out Entity instances, a custom parser factory and a thread local storage for parser instances. It also has a check_docinfo() function which inspects a tree for internal or external DTDs and entity declarations."
It sounds like it would have defused your example of lxml, and perhaps a few others you haven't considered.
Every solution requires either figuring out the problems yourself (which is impossible, given the number of problems that exist), or learning about it from elsewhere. No matter what, there will be people asking the same question you did.
I found out about defusedxml because I read planet.python.org where http://blog.python.org/2013/02/announcing-defusedxml-fixes-f... came up, and because I had enough general understanding of the security problems with XML to recognize why it was created.