python / python/cpython

xml.dom.minidom: serializing a comment ending in '-' silently produces non-well-formed XML

Open
#156,812 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib topic-XML type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

xml.dom.minidom guards comment serialization against -- (illegal inside an XML comment): Comment.writexml raises ValueError if "--" in self.data (test testSerializeCommentNodeWithDoubleHyphen). It misses a comment whose data ends with -: the trailing - fuses with the closing --> into --->, which contains --.

import xml.dom.minidom as m
doc = m.getDOMImplementation().createDocument(None, None, None)
doc.appendChild(doc.createComment("see note-"))
out = doc.toxml()          # '<?xml version="1.0" ?><!--see note--->'
m.parseString(out)         # xml.parsers.expat.ExpatError: not well-formed

minidom silently emits XML it cannot reparse. The existing -- guard already takes the stance that serialization must fail loudly on comment content it cannot represent; the trailing-- case is a gap in that guard.

CPython versions tested on:

CPython main

Operating systems tested on:

Linux, macOS

Linked PRs
  • gh-156813

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with xml.dom.minidom's Comment.writexml implementation and the existing test named testSerializeCommentNodeWithDoubleHyphen. Reproduce serialization of a comment ending in '-' and run the minidom tests; done means the invalid trailing-hyphen case is rejected consistently with comments containing '--'.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.