xml.sax.saxutils.XMLGenerator does not escape the namespace URI

[serhiy-storchaka]

Bug report

XMLGenerator writes namespace declarations with the URI inserted as is. It is the only attribute value in this class which is not written with quoteattr(), so a URI containing &, < or a quote character produces a document which cannot be parsed. Copying a document with such a namespace name is enough to break it.

import io, xml.sax
from xml.sax.saxutils import XMLGenerator

doc = b'<p:doc xmlns:p="http://example.org/?a=1&amp;b=2">text</p:doc>'
out = io.StringIO()
parser = xml.sax.make_parser()
parser.setFeature(xml.sax.handler.feature_namespaces, True)
parser.setContentHandler(XMLGenerator(out))
parser.parse(io.BytesIO(doc))
print(out.getvalue())

Output:

<p:doc xmlns:p="http://example.org/?a=1&b=2">text</p:doc>

Parsing it back fails with "not well-formed (invalid token)". The same happens for < and for a quote character in the URI.

Linked PRs

• gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator #156799
• [3.13] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156856
• [3.14] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156857
• [3.15] gh-156797: Escape the namespace URI in xml.sax.saxutils.XMLGenerator (GH-156799) #156858