Comment 6 for bug 1234114

I agree, it is neither serious nor a security issue. We hadn't noticed the issue before because it used to work all the time.

About the test case:
Yes, it's slightly different because it was more convenient to put the XSD into the same Python file. The outcome is the same for an etree, file=BytesIO() and file=filename.xsd. In all three cases the XSD is loaded from a remote resource despite the default setting no_network=True.