Description

serhiy-storchaka

opened on Sep 1, 2026

Issue body actions

Bug report

XMLGenerator writes namespace declarations with the URI inserted as is. It is the only attribute value in this class which is not written with quoteattr(), so a URI containing &, < or a quote character produces a document which cannot be parsed. Copying a document with such a namespace name is enough to break it.

import io, xml.sax
from xml.sax.saxutils import XMLGenerator

doc = b'<p:doc xmlns:p="http://example.org/?a=1&amp;b=2">text</p:doc>'
out = io.StringIO()
parser = xml.sax.make_parser()
parser.setFeature(xml.sax.handler.feature_namespaces, True)
parser.setContentHandler(XMLGenerator(out))
parser.parse(io.BytesIO(doc))
print(out.getvalue())

Output:

<p:doc xmlns:p="http://example.org/?a=1&b=2">text</p:doc>

Parsing it back fails with "not well-formed (invalid token)". The same happens for < and for a quote character in the URI.

Linked PRs

• gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator #156799
• [3.13] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156856
• [3.14] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156857
• [3.15] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156858

Activity

1. serhiy-storchaka

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   topic-XML

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   3.15bugs and security fixesbugs and security fixes

   3.16new features, bugs and security fixesnew features, bugs and security fixes

   on Sep 1, 2026
2. serhiy-storchaka

   added a commit that references this issue on Sep 2, 2026

   gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (G…

   5056ac5
3. serhiy-storchaka

   closed this as completedon Sep 2, 2026
4. serhiy-storchaka

   added 2 commits that reference this issue on Sep 2, 2026

   [3.13] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…

   2d46d76

   [3.14] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…

   54717b6
5. clin1234

   added a commit that references this issue on Sep 12, 2026

   pythongh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGene…

   d0ce6b0
6. serhiy-storchaka

   added a commit that references this issue on Oct 10, 2026

   [3.15] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…

   657dfc1

Issue actions