  install:
    - pip install $DJANGO
    - "if [[ ${TRAVIS_PYTHON_VERSION::1} != '3' ]]; then pip install django-filter==0.5.4 --use-mirrors; fi"
    - "if [[ ${TRAVIS_PYTHON_VERSION::1} == '3' ]]; then pip install https://github.com/alex/django-filter/tarball/master; fi"
    - export PYTHONPATH=.
  
  script:
    - python rest_framework/runtests/runtests.py
 
</s> remove         parser = ET_XMLParser(encoding=encoding)
 </s> add         parser = etree.DefusedXMLParser(encoding=encoding) </s> remove             tree = ET.parse(stream, parser=parser)
        except (ExpatError, ETParseError, ValueError) as exc:
 </s> add             tree = etree.parse(stream, parser=parser)
        except (etree.ParseError, ValueError) as exc: </s> remove # xml.etree.parse only throws ParseError for python >= 2.7
 </s> add # XML is optional </s> remove     from xml.etree import ParseError as ETParseError
except ImportError:  # python < 2.7
    ETParseError = None


# XMLParser only takes an encoding arg from >= 2.7
def ET_XMLParser(encoding=None):
    from xml.etree import ElementTree as ET
    try:
        return ET.XMLParser(encoding=encoding)
    except TypeError:
        return ET.XMLParser()
 </s> add     import defusedxml.ElementTree as etree
except ImportError:
    etree = None
  - pip install defusedxml==0.3
  install:
    - pip install $DJANGO
  - pip install defusedxml==0.3
    - "if [[ ${TRAVIS_PYTHON_VERSION::1} != '3' ]]; then pip install django-filter==0.5.4 --use-mirrors; fi"
    - "if [[ ${TRAVIS_PYTHON_VERSION::1} == '3' ]]; then pip install https://github.com/alex/django-filter/tarball/master; fi"
    - export PYTHONPATH=.
  
  script:
    - python rest_framework/runtests/runtests.py
keep add keep keep keep keep keep keep
 defusedxml for security fix.

As per:
http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html 
.travis.yml