GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator by serhiy-storchaka · Pull Request #156799 · python/cpython

Conversation

@serhiy-storchaka

@serhiy-storchaka serhiy-storchaka commented Sep 1, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

The namespace declarations were the only attribute values written without quoteattr(), so a URI containing &, < or a quote character produced a document which cannot be parsed.

  • Issue: xml.sax.saxutils.XMLGenerator does not escape the namespace URI #156797

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@serhiy-storchaka
pythongh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGene…
fe4de69 
…rator

The namespace declarations were the only attribute values written without
quoteattr(), so a URI containing "&", "<" or a quote character produced a
document which cannot be parsed.
@bedevere-app bedevere-app Bot mentioned this pull request Sep 1, 2026
xml.sax.saxutils.XMLGenerator does not escape the namespace URI #156797
Closed
@bedevere-app bedevere-app Bot added the awaiting core review label Sep 1, 2026
This was referenced Sep 1, 2026
gh-57092: Add the validate option to xml.sax.saxutils.XMLGenerator #156800
Open
xml.sax.xmlreader.AttributesImpl allows empty string as attribute names #57092
Open
eendebakpt
eendebakpt approved these changes Sep 1, 2026
View reviewed changes
Comment thread Lib/test/test_sax.py
gen = XMLGenerator(result)

gen.startDocument()
gen.startPrefixMapping("ns1", uri)

@eendebakpt eendebakpt Sep 1, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could do a gen.startPrefixMapping(None, uri2) here to cover the other branch.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Sep 1, 2026
@serhiy-storchaka
serhiy-storchaka merged commit 5056ac5 into python:main Sep 2, 2026
104 of 106 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Sep 2, 2026
@serhiy-storchaka
serhiy-storchaka deleted the sax-xmlgen-quoteattr branch September 2, 2026 21:10
@serhiy-storchaka serhiy-storchaka added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Sep 2, 2026
@miss-islington-app

miss-islington-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

GH-156856 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 2, 2026
@bedevere-app

bedevere-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

GH-156857 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 2, 2026
@bedevere-app

bedevere-app Bot commented Sep 2, 2026

Copy link
Copy Markdown

GH-156858 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Sep 2, 2026
serhiy-storchaka added a commit that referenced this pull request Sep 2, 2026
@miss-islington @serhiy-storchaka
[3.13] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…
2d46d76 
…erator (GH-156799) (GH-156856)

The namespace declarations were the only attribute values written without
quoteattr(), so a URI containing "&", "<" or a quote character produced a
document which cannot be parsed.
(cherry picked from commit 5056ac5)

Co-authored-by: Serhiy Storchaka <[email protected]>
serhiy-storchaka added a commit that referenced this pull request Sep 2, 2026
@miss-islington @serhiy-storchaka
[3.14] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…
54717b6 
…erator (GH-156799) (GH-156857)

The namespace declarations were the only attribute values written without
quoteattr(), so a URI containing "&", "<" or a quote character produced a
document which cannot be parsed.
(cherry picked from commit 5056ac5)

Co-authored-by: Serhiy Storchaka <[email protected]>
@bedevere-bot

bedevere-bot commented Sep 2, 2026

Copy link
Copy Markdown

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Debian root 3.13 (tier-1) has failed when building commit 2d46d76.

What do you need to do:

  1. Don't panic.
  2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
  3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1441/builds/2329) and take a look at the build logs.
  4. Check if the failure is related to this commit (2d46d76) or if it is a false positive.
  5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1441/builds/2329

Summary of the results of the build (if available):

==

Click to see traceback logs 
Traceback (most recent call last):
  File "/root/buildarea/3.13.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 857, in gc_collect
    gc.collect()
ResourceWarning: unclosed file <_io.FileIO name=13 mode='wb' closefd=True>


Traceback (most recent call last):
  File "/root/buildarea/3.13.angelico-debian-amd64/build/Lib/test/support/__init__.py", line 857, in gc_collect
    gc.collect()
ResourceWarning: unclosed file <_io.FileIO name=11 mode='wb' closefd=True>
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
clin1234 pushed a commit to clin1234/cpython that referenced this pull request Sep 12, 2026
@serhiy-storchaka @clin1234
pythongh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGene…
d0ce6b0 
…rator (pythonGH-156799)

The namespace declarations were the only attribute values written without
quoteattr(), so a URI containing "&", "<" or a quote character produced a
document which cannot be parsed.
serhiy-storchaka added a commit that referenced this pull request Oct 10, 2026
@miss-islington @serhiy-storchaka
[3.15] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGen…
657dfc1 
…erator (GH-156799) (GH-156858)

The namespace declarations were the only attribute values written without
quoteattr(), so a URI containing "&", "<" or a quote character produced a
document which cannot be parsed.
(cherry picked from commit 5056ac5)

Co-authored-by: Serhiy Storchaka <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eendebakpt eendebakpt eendebakpt approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@serhiy-storchaka @bedevere-bot @eendebakpt
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.