Ammar: yep, that's correct. There's code in defused's ElementTree.py - _ get_py3_cls() - which passes different values to _generate_etree_functions based on the Python 3 version.

For Python 3.2+, defused 0.4.1 expects to use the _IterParseIterator class from xml ElementTree , but that got removed in 3.6, so if you just use defused 0.4.1 with Python 3.6, it asserts as soon as you try to import defusedxml.ElementTree at all:

>>> import defusedxml.ElementTree
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/defusedxml-0.4.1/defusedxml/ElementTree.py", line 62, in <module>
    _XMLParser, _iterparse, _IterParseIterator, ParseError = _get_py3_cls()
  File "/tmp/defusedxml-0.4.1/defusedxml/ElementTree.py", line 56, in _get_py3_cls
    _IterParseIterator = pure_pymod._IterParseIterator
AttributeError: module 'xml.etree.ElementTree' has no attribute '_IterParseIterator'

Christian made a change to make _get_py3_cls() pass None to _generate_etree_functions() so you can at least import defusedxml.ElementTree, but he didn't change _generate_etree_functions() at all so it just doesn't have a code path that handles this at all; for Python 3.2+ it's expecting to get a real iterator, not None, and it just breaks completely trying to use None as an iterator:

<mock-chroot> sh-4.3# echo "<xml></xml>" > test.xml
<mock-chroot> sh-4.3# python3
>>> import defusedxml.ElementTree
>>> parser = defusedxml.ElementTree.iterparse('test.xml')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/defusedxml-0.4.1/defusedxml/common.py", line 141, in iterparse
    return _IterParseIterator(source, events, parser, close_source)
TypeError: 'NoneType' object is not callable

Serhiy, thanks for the suggestion! We'll try that out.