  
      def parse(self, stream, media_type=None, parser_context=None):
          parser_context = parser_context or {}
          encoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)
          parser = etree.DefusedXMLParser(encoding=encoding)
          try:
              tree = etree.parse(stream, parser=parser)
          except (etree.ParseError, ValueError) as exc:
 
</s> remove         parser = ET_XMLParser(encoding=encoding)
 </s> add         parser = etree.DefusedXMLParser(encoding=encoding) </s> remove             tree = ET.parse(stream, parser=parser)
        except (ExpatError, ETParseError, ValueError) as exc:
 </s> add             tree = etree.parse(stream, parser=parser)
        except (etree.ParseError, ValueError) as exc: </s> remove     from xml.etree import ParseError as ETParseError
except ImportError:  # python < 2.7
    ETParseError = None


# XMLParser only takes an encoding arg from >= 2.7
def ET_XMLParser(encoding=None):
    from xml.etree import ElementTree as ET
    try:
        return ET.XMLParser(encoding=encoding)
    except TypeError:
        return ET.XMLParser()
 </s> add     import defusedxml.ElementTree as etree
except ImportError:
    etree = None
        assert etree, 'XMLParser requires defusedxml to be installed'

  
      def parse(self, stream, media_type=None, parser_context=None):
        assert etree, 'XMLParser requires defusedxml to be installed'

          parser_context = parser_context or {}
          encoding = parser_context.get('encoding', settings.DEFAULT_CHARSET)
          parser = etree.DefusedXMLParser(encoding=encoding)
          try:
              tree = etree.parse(stream, parser=parser)
          except (etree.ParseError, ValueError) as exc:
keep add keep keep keep keep keep keep
 defusedxml for security fix.

As per:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html 
rest_framework/parsers.py