GeezerVison is showing github.com — Add option to validate ElementTree during serialization · Issue #149468 · python/cpython
Add option to validate ElementTree during serialization #149468DescriptionFeature or enhancement
Proposal:
ElementTree can be serialized to XML and HTML formats. While special characters like & and < are escaped in text and attribute values, there is no way to escape arbitrary characters in element and attribute names, comments, processing instructions and HTML elements like <script>. Also, not all characters can be represented in XML and HTML, for example the null character cannot.
This is usually not a problem, because the structure of the element tree is usually hardcoded and variable parts have reasonable values. But if the element tree is constructed using arbitrary user data, it is possible to inject some elements. For example, if the comment is '--><tag>...</tag><!--'.
It is considered the user's responsibility to ensure that the element tree is valid. But we can help them. The proposed PR add the validate option to serialization functions which enables validation if true. It is the option of serialization because rules are different for XML and HTML.
Has this already been discussed elsewhere?
No response given
Links to previous discussion of this feature:
No response
Linked PRs
Activitymerwok commented on May 6, 2026 A question and a recommendation:
1: It seems cleaner to separate validation and serialization, but I assume you’re adding it in this way because it would be inefficient to visit the whole tree twice, right?
2: «XML validation» brings to mind checking the contents against an XML schema. Here the check done corresponds to the concept of «well-formed» (purely syntactic). Could you rename the parameters and adapt the doc? serhiy-storchaka commented on May 7, 2026 The tree is already visited twice to handle namespaces. With separate validation function we would need to visit it four times. Also, it would be easier to miss something. And the rules depend on the output format, so we would need to pass all relevant arguments to both functions.
Yes, this is not XML validation in narrow meaning, but it is even weaker then well-formedness. It only guarantees that the output does not contain illegal characters and guards against XML injections. Some well-formedness constrains are satisfied automatically (matching opening and closing tags), others are not enforced (e.g. uniqueness of attribute names). In XML 1.1 there is a difference between character set supported by parsers and character set in well-formed document (Python currently does not support XML 1.1). Constrains on HTML element and attribute names are very weak -- they only guarantee that that it can be parsed by a permissive HTML5 parser.
So, I think that the documentation for this feature could be better. I just have not came with good variant. scoder commented on May 8, 2026
The tree is already visited twice to handle namespaces. With separate validation function we would need to visit it four times. Also, it would be easier to miss something. And the rules depend on the output format, so we would need to pass all relevant arguments to both functions.
But this form of validation is something that most users won't need. And for those who need it, it can be fairly late if problems are only detected during serialisation and not while building the tree. Really, this kind of malicious content should be detected by user code on the way in, not on the way out. So at least some of the potential users would probably still prefer to do their own validation upfront and not make use of the new serialisation option.
I'm not convinced that this is worth adding to the serialiser. serhiy-storchaka commented on May 8, 2026 This is why we added xml.is_valid_name() and xml.is_valid_text() (see #139489). But then we need more complex checks for comments and processing instructions, and the way ElementTree handles names with namespaces need special processing. And HTML needs completely different set of checks. A single option just simplifies this for user, but you a free to do these checks yourself. merwok commented on May 8, 2026 Honestly I didn’t know that ElementTree supported HTML!
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|