Mailman 3 August 2022 - lxml - The Python XML Toolkit

Where to report security issues
by Tim McCormack 26 Aug '22

26 Aug '22

I have a couple of low-to-moderate severity vulnerabilities to report in lxml.html.clean (and would be happy to submit tests and patches). I did not see a designated security contact or reporting process. What process should I use? - Tim McCormack

2 2

Adding HTML inside XML
by karl＠cs.stanford.edu 19 Aug '22

19 Aug '22

Hello, I need to add some HTML inside XML. The result should look like this: <content> <![CDATA[<?xml version="1.0" encoding="UTF-8" standalone="no"?> <!DOCTYPE en-note SYSTEM "http://xml.evernote.com/pub/enml2.dtd"><en-note>line oneline two</en-note>]]> </content> the code i'm using is this: # read html from file - result is : content_text = 'line oneline two' en_note_el = etree.Element('en-note') en_note_el.text = content_text en_note_doctype = '<!DOCTYPE en-note SYSTEM "http://xml.evernote.com/pub/enml2.dtd">' en_note_str = etree.tostring(en_note_el, encoding='UTF-8', method="xml", xml_declaration=True, pretty_print=False, standalone=False, doctype=en_note_doctype) content_el = etree.SubElement(note_el, 'content') content_el.text = etree.CDATA(en_note_str) == This works, except the included HTML in the text element of en-note is escaped. Can you help me figure how to not have it be escaped? The contents inside the <en-note> tags are supposed to be valid HTML, but without any <html> or <body> sections, and there isn't really a root element.

2 1

How to update the `lxml` view of a tree modified at the `libxml2` level?
by Dieter Maurer 08 Aug '22

08 Aug '22

In `dm.xmlsec.binding` ("https://pypi.org/project/dm.xmlsec.binding/"), I integrate Aleksey Sanin's XML security library ("http://www.aleksey.com/xmlsec") with `lxml`, both `libxml2` based. Recently, one of its encryption/decryption tests started to fail. This test uses a tree of the form: <root> ... <to_be_encrypted>...</to_be_encrypted> ... </root> The encryption transforms it (directly at the `libxml2` level) to the form <root> ... <encrypted>...</encypted> ... </root> An `lxml` proxy to the new node `encrypted` is returned. The test calls `getroottree` on this proxy to update `lxml`'s view of the modified tree. In older `lxml` versions, this has been successful. However, in `lxml==4.9.1` (maybe already before this version) the view is inconsistent: with `ENC="{http://www.w3.org/2001/04/xmlenc#}EncryptedData` and an element `E`, I get: `E[0].tag == ENC` but `E.find(ENC) is None`. Apparently, `__getitem__` (behind `E[0]`) is aware of the modification but `find` is not. How the `lxml` view of a tree modified at the `libxml2` leval can be reliably updated? For preciseness =============== The XML serialization of the inconsistent view is:  <Envelope xmlns="urn:envelope"> <EncryptedData xmlns="http://www.w3.org/2001/04/xmlenc#" Type="http://www.w3.org/2001/04/xmlenc#Element"> <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/> <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> <KeyName>deskey.bin</KeyName> </KeyInfo> <CipherData> <CipherValue>FwsuAoPgBzvCjr3K2q+VLcX4U+NzpHZ6orcSzbe3OrTcu3PrxWnHqg==</CipherValue> </CipherData> </EncryptedData> </Envelope> The `E` in the section above is this document's root element (i.e. `{urn:envelope}Envelope`). Its child `0` has been replaced by the encryption. It is this element which is not seen by `find`. -- Dieter

1 0