Description

tonghuaroot

opened on Sep 2, 2026

Issue body actions

Bug report

Bug description:

xml.dom.minidom guards comment serialization against -- (illegal inside an XML comment): Comment.writexml raises ValueError if "--" in self.data (test testSerializeCommentNodeWithDoubleHyphen). It misses a comment whose data ends with -: the trailing - fuses with the closing --> into --->, which contains --.

import xml.dom.minidom as m
doc = m.getDOMImplementation().createDocument(None, None, None)
doc.appendChild(doc.createComment("see note-"))
out = doc.toxml()          # '<?xml version="1.0" ?><!--see note--->'
m.parseString(out)         # xml.parsers.expat.ExpatError: not well-formed

minidom silently emits XML it cannot reparse. The existing -- guard already takes the stance that serialization must fail loudly on comment content it cannot represent; the trailing-- case is a gap in that guard.

CPython versions tested on:

CPython main

Operating systems tested on:

Linux, macOS

Linked PRs

• gh-156812: Reject a trailing '-' when serializing an xml.dom.minidom comment #156813
• gh-156812: Check structural rules when serializing in xml.dom.minidom #161830

Activity

1. aisk

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   topic-XML

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Sep 2, 2026
2. serhiy-storchaka commented on Nov 11, 2026

   

   serhiy-storchaka

   on Nov 11, 2026

   Member

   More actions

   Thank you for the report.

   Processing instructions have the same gap, and are not checked at all: '?>' in the data silently closes the instruction, and the reserved target xml produces a document which cannot be parsed.

   >>> import xml.dom.minidom as m
   >>> doc = m.parseString('<r/>')
   >>> doc.documentElement.appendChild(doc.createProcessingInstruction('p', 'a?>b'))
   >>> out = doc.toxml(); out
   '<?xml version="1.0" ?><r><?p a?>b?></r>'
   >>> [(n.nodeName, n.data) for n in m.parseString(out).documentElement.childNodes]
   [('p', 'a'), ('#text', 'b?>')]

   The document type declaration is worse: the identifiers are interpolated into single quotes without any checks, so an identifier containing a quote or a character which is not allowed in it makes the declaration unparseable, and a public identifier without a system identifier is written as PUBLIC 'p' 'None'.

   PR #161830 fixes all these cases, including the comment ending with -, so it supersedes #156813.

   It only checks the structural rules. The characters in the text, in attribute values and in the content of comments, processing instructions and CDATA sections are still not checked: \x00, \x0c, \x1f and lone surrogates are written as is. Checking them costs 25–40% of the serialization time for ordinary documents, and up to 10 times more for documents with large text nodes, so it would need an option, like the validate option of the ElementTree serializer in #149469. For now this is documented.

Issue actions