[Docutils-checkins] SF.net SVN: docutils:[10395] trunk/docutils

[<mi...@us...>]

Revision: 10395
          http://sourceforge.net/p/docutils/code/10395
Author:   milde
Date:     2026-08-22 20:59:31 +0000 (Sat, 22 Aug 2026)
Log Message:
-----------
Stop XML writer from loading external entities when checking raw XML.

Do not activate the "external-general-entities" feature
of the SAX parser used to check raw XML content.

Fixes [bugs:#521].

Modified Paths:
--------------
    trunk/docutils/HISTORY.rst
    trunk/docutils/docutils/writers/docutils_xml.py

Modified: trunk/docutils/HISTORY.rst
===================================================================
--- trunk/docutils/HISTORY.rst	2026-08-21 08:27:55 UTC (rev 10394)
+++ trunk/docutils/HISTORY.rst	2026-08-22 20:59:31 UTC (rev 10395)
@@ -179,7 +179,12 @@
     by the HTML writers are of data type str.")
   - HTML-escape `interpolation_dict` values extracted from the index.
 
+* docutils/writers/docutils_xml.py
 
+  - Do not activate the "external-general-entities" feature of the
+    SAX parser used to check raw XML content.  Fixes bug #521.
+
+
 Release 0.23 (2026-05-27)
 =========================
 

Modified: trunk/docutils/docutils/writers/docutils_xml.py
===================================================================
--- trunk/docutils/docutils/writers/docutils_xml.py	2026-08-21 08:27:55 UTC (rev 10394)
+++ trunk/docutils/docutils/writers/docutils_xml.py	2026-08-22 20:59:31 UTC (rev 10395)
@@ -75,9 +75,7 @@
     generator = '<!-- Generated by Docutils %s -->\n'
 
     xmlparser = xml.sax.make_parser()
-    """SAX parser instance to check/extract raw XML."""
-    xmlparser.setFeature(
-        "http://xml.org/sax/features/external-general-entities", True)
+    """SAX parser instance to check raw XML."""
 
     def __init__(self, document) -> None:
         nodes.NodeVisitor.__init__(self, document)
@@ -170,7 +168,7 @@
         xml_string = node.astext()
         self.output.append(xml_string)
         self.default_departure(node)  # or not?
-        # Check validity of raw XML:
+        # Parse XML content to check for errors:
         try:
             self.xmlparser.parse(StringIO(xml_string))
         except xml.sax._exceptions.SAXParseException:
@@ -179,8 +177,8 @@
             srcline = node.line
             if not isinstance(node.parent, nodes.TextElement):
                 srcline += 2  # directive content start line
-            msg = 'Invalid raw XML in column %d, line offset %d:\n%s' % (
-                   col_num, line_num, node.astext())
+            msg = (f'Invalid raw XML in column {col_num}, '
+                   f'line offset {line_num}:\n{node.astext()}')
             self.warn(msg, source=node.source, line=srcline+line_num-1)
         raise nodes.SkipNode  # content already processed
 

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.