GeezerVison is showing github.com — Add warning to `xml.sax.saxutils.XMLGenerator` about untrusted inputs · Issue #139478 · python/cpython
Add warning to xml.sax.saxutils.XMLGenerator about untrusted inputs #139478DescriptionThe xml.sax.saxutils.XMLGenerator class doesn't warn users that inputs are not validated and therefore validation, if required due to untrusted input, is the user responsibility.
Linked PRs
Activityserhiy-storchaka commented on Oct 1, 2025 I do not think that placing such loud warning before the class description is a good idea.
First, the purpose of this class is to reproduce the equivalent XML document from the sequence of SAX events. SAX events produced by the XML parser do not need validation. Any other use of this class is not intended use.
If add any note, it should be after the class description. And I doubt about the use of the warning directive, it should be reserved for more serious cases. The note directive or the plain text should be enough. Be careful not to add incorrect signal about the intended use of XMLGenerator.
Second, there is a larger elephant in the room. There are several other XML generators in the stdlib: minidom, ElementTree, xmlrpc, plistlib, libregrtest, maybe more. And almost no one of them validate the user data, even if they are purposed to be used with arbitrary user data (unlike to XMLGenerator). sethmlarson commented on Oct 1, 2025 ContributorAuthor More actions
First, the purpose of this class is to reproduce the equivalent XML document from the sequence of SAX events. SAX events produced by the XML parser do not need validation. Any other use of this class is not intended use.
This seems like a good reason to modify the warning (and change it to a note). If you have specifics you can propose them in the pull request, otherwise I'll try my best.
Second, there is a larger elephant in the room. There are several other XML generators in the stdlib: minidom, ElementTree, xmlrpc, plistlib, libregrtest, maybe more. And almost no one of them validate the user data, even if they are purposed to be used with arbitrary user data (unlike to XMLGenerator).
If arbitrary user data is being processed then someone needs to do the validation. If we intend that someone to be the user, and it's probable that a user might mistakenly think we're doing the validation when we're not, then we should be documenting that fact somewhere. sethmlarson commented on Oct 1, 2025 ContributorAuthor More actions serhiy-storchaka commented on Oct 1, 2025 I suggest to look at global picture. What other modules have such issue? Then we should add standardized notes/warnings for all modules.
Even if use of XMLGenerator for XML generation is not intended, people use it for this (at least one case), so it makes sense to add such note/warning here too. But only after other modules.
cc @vstinner which added a workaround for similar issue in regrtest (#121188). serhiy-storchaka commented on Sep 1, 2026
MetadataMetadataStatusShow more project fields
DevelopmentNo branches or pull requestsIssue actions
|