Whole file

martinblech/xmltodict

The author described this change as “fix: validate XML comments”. It counts as a record because the checks below fail on the code as it stood at b4a5f2a3f and pass on 3d4d2d3a4, with nothing else changed between the two runs.

Projectmartinblech/xmltodict

Fix saved2025-09-16

Sharing licenceMIT · LICENSE

Change size+17 −1

What the code was meant to do, written into the code itself as a save note

fix: validate XML comments

The change

402	402		raise ValueError(f"Invalid {kind} name: whitespace not allowed")
403	403
404	404
	405	+	def _validate_comment(value):
	406	+	if isinstance(value, bytes):
	407	+	try:
	408	+	value = value.decode("utf-8")
	409	+	except UnicodeDecodeError as exc:
	410	+	raise ValueError("Comment text must be valid UTF-8") from exc
	411	+	if not isinstance(value, str):
	412	+	raise ValueError("Comment text must be a string")
	413	+	if "--" in value:
	414	+	raise ValueError("Comment text cannot contain '--'")
	415	+	if value.endswith("-"):
	416	+	raise ValueError("Comment text cannot end with '-'")
	417	+	return value
	418	+
	419	+
405	420		def _process_namespace(name, namespaces, ns_sep=':', attr_prefix='@'):
406	421		if not isinstance(name, str):
407	422		return name
⋯
440	455		if comment_text is None:
441	456		continue
442	457		comment_text = _convert_value_to_string(comment_text)
443		-	if comment_text == "":
	458	+	if not comment_text:
444	459		continue
445	460		if pretty:
446	461		content_handler.ignorableWhitespace(depth * indent)
⋯
520	535
521	536		class _XMLGenerator(XMLGenerator):
522	537		def comment(self, text):
	538	+	text = _validate_comment(text)
523	539		self._write(f"<!--{escape(text)}-->")
524	540
525	541

The check that tells the two apart

fail→pass·tests/test_dicttoxml.py::test_unparse_rejects_comment_ending_with_hyphen

fail→pass·tests/test_dicttoxml.py::test_unparse_rejects_comment_with_double_hyphen

Check file tests/test_dicttoxml.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.

Origin and history

The fix3d4d2d3a4cd0f68d1211dba549010261fa87b969

The code before itb4a5f2a3f04aff68384486e957632c8438396fd6

Broken version dated2025-09-16

Modulexmltodict

Units changed_XMLGenerator, _emit

Fingerprintc87f2ba243b5d4ec

Checked2026-08-18 by goldset/0.1

Every field above is generated by our program. None of it is written by hand.

What the code was meant to do, written into the code itself as a save note

The change

The check that tells the two apart

Origin and history

Other bugs found in martinblech/xmltodict