python / python/cpython

xml.etree.ElementTree.register_namespace() does not validate the prefix

Open
#157,518 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib topic-XML type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

The documentation of register_namespace() says that ValueError is raised "if prefix is reserved or is invalid", but only the reserved form ns followed by digits is checked. Any other string is accepted, and the serializer then produces XML which is not well-formed or not namespace-well-formed:

>>> import xml.etree.ElementTree as ET
>>> def show(prefix, uri):
...     ET.register_namespace(prefix, uri)
...     print(ET.tostring(ET.Element(f'{{{uri}}}a', {f'{{{uri}}}k': 'v'}), encoding='unicode'))
...
>>> show('xml', 'u')
<xml:a xml:k="v" />
>>> show('foo', 'http://www.w3.org/XML/1998/namespace')
<foo:a xmlns:foo="http://www.w3.org/XML/1998/namespace" foo:k="v" />
>>> show('xmlns', 'u')
<xmlns:a xmlns:xmlns="u" xmlns:k="v" />
>>> show('a:b', 'u')
<a:b:a xmlns:a:b="u" a:b:k="v" />
>>> show('a b', 'u')
<a b:a xmlns:a b="u" a b:k="v" />

The xml prefix can only be bound to http://www.w3.org/XML/1998/namespace and no other prefix can be bound to it, xmlns cannot be used as a prefix, and a prefix must be an NCName (Namespaces in XML 1.0, sections 3 and 4). register_namespace() should raise ValueError in these cases, like it does for the reserved prefixes.

The empty prefix, which registers a global default namespace, is a separate case, see gh-118416.

Linked PRs
  • gh-157521

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at xml.etree.ElementTree.register_namespace() and compare its documented validation with the invalid prefix and namespace bindings shown in the report. The change is done when these cases raise ValueError while the empty-prefix case remains separate; gh-157521 is the linked PR to inspect for work already underway.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.