classification
Title: ServerProxy should not make requests with malformed XML
Type: behavior Stage:
Components: XML Versions: Python 3.7, Python 3.6, Python 3.5, Python 3.4, Python 3.3, Python 2.7
process
Status: open Resolution: duplicate
Dependencies: Superseder: xmlrpc library returns string which contain null ( \x00 )
View: 7727
Assigned To: Nosy List: Alex Corcoles, serhiy.storchaka
Priority: normal Keywords:

Created on 2017-07-12 15:22 by Alex Corcoles, last changed 2017-07-12 16:34 by serhiy.storchaka.

Messages (2)
msg298226 - (view) Author: Alex Corcoles (Alex Corcoles) Date: 2017-07-12 15:22
https://docs.python.org/3.7/library/xmlrpc.client.html says:

"""
When passing strings, characters special to XML such as <, >, and & will be automatically escaped. However, it’s the caller’s responsibility to ensure that the string is free of characters that aren’t allowed in XML, such as the control characters with ASCII values between 0 and 31 (except, of course, tab, newline and carriage return); failing to do this will result in an XML-RPC request that isn’t well-formed XML. If you have to pass arbitrary bytes via XML-RPC, use bytes or bytearray classes or the Binary wrapper class described below.
"""

The XML-RPC spec at http://xmlrpc.scripting.com/spec.html says:

"""
What characters are allowed in strings? Non-printable characters? Null characters? Can a "string" be used to hold an arbitrary chunk of binary data?

Any characters are allowed in a string except < and &, which are encoded as &lt; and &amp;. A string can be used to encode binary data.
"""

I believe strings should be XML-escaped correctly or at the very least, an assertion should be made to ensure no malformed XML is ever generated.
msg298233 - (view) Author: Serhiy Storchaka (serhiy.storchaka) * (Python committer) Date: 2017-07-12 16:34
This looks like a duplicate of issue7727.
History
Date User Action Args
2017-07-12 16:34:07serhiy.storchakasetnosy: + serhiy.storchaka
messages: + msg298233
resolution: duplicate

superseder: xmlrpc library returns string which contain null ( \x00 )
2017-07-12 15:22:13Alex Corcolescreate