python / python/cpython

plistlib: a <key> outside a <dict> raises IndexError instead of a proper error

Open
#152,959 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib type-feature
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

plistlib.loads on an XML plist whose <key> element appears outside a
<dict> raises an uncaught IndexError instead of a ValueError.

_PlistParser.end_key checks self.stack[-1] without first testing whether
the stack is empty:

def end_key(self):
    if self.current_key or not isinstance(self.stack[-1], dict):
        raise ValueError("unexpected key at line %d" %
                         self.parser.CurrentLineNumber)
    self.current_key = self.get_data()

When a <key> is the document's top-level element there is no enclosing
container on the stack, so self.stack[-1] raises IndexError.

Reproducer:

>>> import plistlib
>>> plistlib.loads(b"<plist><key>x</key></plist>")
Traceback (most recent call last):
  ...
IndexError: list index out of range

The sibling handler add_object (used by <integer>, <string>, etc.)
already guards the empty-stack case with elif not self.stack:, so scalar
elements at the top level are handled cleanly. A <key> outside a <dict>
should likewise raise a ValueError, consistent with the other malformed
inputs the parser rejects.

The binary plist format does not use this code path and is unaffected.

Versions

3.15 (main); the same code is present on 3.13 and 3.14.

Linked PRs
  • gh-152960
  • gh-152970

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in plistlib at _PlistParser.end_key and compare its stack handling with add_object. Reproduce the top-level case with plistlib.loads, then verify that malformed XML plist input raises ValueError rather than IndexError; linked PRs gh-152960 and gh-152970 indicate the work is already underway.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.