Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

encoding/xml: does not parse internal subset of DTD as required by standard #68388

Open
Tracked by #68293
DemiMarie opened this issue Jul 11, 2024 · 2 comments
Open
Tracked by #68293

encoding/xml: does not parse internal subset of DTD as required by standard #68388

DemiMarie opened this issue Jul 11, 2024 · 2 comments
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Comments

@DemiMarie
Copy link
Contributor

Go version

1.22 I believe

Output of go env in your module/workspace:

Whatever is on https://go.dev/play

What did you do?

Parse XML files with ill-formed or misplaced directives, such as:

  1.  <!BOGUS><a/>
  2. <!DOCTYPE JUNK A><a/>
  3. <a/><!DOCTYPE a>

https://go.dev/play/p/ZzfA0W3EUMJ has an example.

What did you see happen?

Documents are wrongly accepted, in violation of the XML spec.

What did you expect to see?

Either encoding/xml performs the checks on directives that non-validating parsers must perform, or all directives (including DTDs) are rejected by default. The latter is what .NET’s XML parser does: by default, DTDs are a fatal parse error.
@gabyhelp
Copy link

Related Issues and Documentation

(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)

@seankhliao seankhliao added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 13, 2024
@gabyhelp gabyhelp mentioned this issue Jul 16, 2024
Open
@DemiMarie DemiMarie mentioned this issue Jul 16, 2024
Open
14 tasks
@DemiMarie
Copy link
Contributor Author

There are at least two possible fixes here:

  1. Actually parse the DTD. This is complex and a slow path, so I would prefer to use a goyacc-generated parser rather than a handwritten one.
  2. By default, return an error if a DTD is present at all.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@DemiMarie @seankhliao @gabyhelp