Description

assignee = None
closed_at = None
created_at = <Date 2011-09-02.10:04:02.189>
labels = ['expert-XML', 'type-bug', '3.11']
title = 'xml.sax.xmlreader.AttributesImpl allows empty string as attribute names'
updated_at = <Date 2021-04-30.10:10:21.477>
user = 'https://bugs.python.org/MichaelSulyaev'

activity = <Date 2021-04-30.10:10:21.477>
actor = 'iritkatriel'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['XML']
creation = <Date 2011-09-02.10:04:02.189>
creator = 'Michael.Sulyaev'
dependencies = []
files = ['28915']
hgrepos = []
issue_num = 12883
keywords = ['patch']
message_count = 4.0
messages = ['143391', '180964', '181008', '392406']
nosy_count = 4.0
nosy_names = ['Ramchandra Apte', 'Michael.Sulyaev', 'Chenguang.Wang', 'iritkatriel']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue12883'
versions = ['Python 3.11']

Activity

1. MichaelSulyaev commented on Sep 2, 2011

   

   MichaelSulyaevmannequin

   on Sep 2, 2011

   MannequinAuthor

   More actions

   I can get not-well-formed XML output (attribute name must not be empty string):

   <?xml version="1.0" encoding="iso-8859-1"?>
   <root ="v_for_empty_name" k1="v1"></root>

   AttributeImpl must ignore dict entries that may not be cast to valid XML attributes.

   Code:

   #!/usr/bin/python

   from xml.sax.xmlreader import AttributesImpl as Attrs
   from xml.sax.saxutils import XMLGenerator as Gen
   
   g = Gen()
   a = Attrs(dict([('k1','v1'),('','v_for_empty_name')]))
   g.startDocument()
   g.startElement('root',a)
   g.endElement('root')
   g.endDocument()
   print
2. MichaelSulyaev

   added

   topic-XML

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Sep 2, 2011
3. RamchandraApte commented on Jan 30, 2013

   

   RamchandraAptemannequin

   on Jan 30, 2013

   Mannequin

   More actions

   bump...
4. ChenguangWang commented on Jan 31, 2013

   

   ChenguangWangmannequin

   on Jan 31, 2013

   Mannequin

   More actions

   I found this problem is still not fixed in the lastest hg version. Seriously?

   This patch is for the latest v3.4.0a0.
5. iritkatriel commented on Apr 30, 2021

   

   iritkatriel

   on Apr 30, 2021

   Member

   More actions

   I don't think the proposed patch is an acceptable solution. It silently skips invalid attributes.

   It would be ok to either raise an exception or to leave it as it is (junk-in-junk-out). I'm not sure which is better.
6. iritkatriel

   added

   3.11only security fixesonly security fixes

   on Apr 30, 2021
7. ezio-melotti

   transferred this issue fromon Apr 10, 2022
8. iritkatriel

   added

   type-featureA feature request or enhancementA feature request or enhancement

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   3.13only security fixesonly security fixes

   and removed

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   3.11only security fixesonly security fixes

   on Nov 22, 2023
9. iritkatriel commented on Nov 22, 2023

   

   iritkatriel

   on Nov 22, 2023

   Member

   More actions

   The documentation doesn't say anything about input validation, so this is a feature request rather than a bug.
10. serhiy-storchaka commented on Sep 1, 2026

    

    serhiy-storchaka

    on Sep 1, 2026

    Member

    More actions

    PR #156800 adds the validate option instead of always checking the input.

    XMLGenerator is a content handler, so its usual input is the output of a parser, which is always valid. Validating names and characters almost doubles the time of generating a document, and everybody would pay for this. With validate=True the example from the first message is rejected with ValueError, as are illegal characters, invalid namespace prefixes and processing instructions which cannot be represented in a well-formed document.

    This matches the validate option proposed for xml.etree.ElementTree in #149469.

    While writing it I found that namespace URIs are not escaped at all, which is a separate bug: gh-156797, PR #156799.
11. serhiy-storchaka

    added a commit that references this issue on Sep 2, 2026

    Merge remote-tracking branch 'upstream/main' into pythongh-57092-xmlg…

    a3a266c
12. serhiy-storchaka

    added a commit that references this issue on Nov 11, 2026

    Merge remote-tracking branch 'upstream/main' into pythongh-57092-xmlg…

    347e135

Issue actions