Whole file
martinblech/xmltodict
The author described this change as “fix: allow DOCTYPE with disable_entities=True (default)”. It counts as a record because the checks below fail on the code as it stood at a2a9ab7e0 and pass on 25b61a41f, with nothing else changed between the two runs.
Projectmartinblech/xmltodict
Fix saved2025-09-17
Sharing licenceMIT · LICENSE
Change size+1 −14
What the code was meant to do, written into the code itself as a save note
fix: allow DOCTYPE with disable_entities=True (default)
The change
| 355 | 355 | parser.buffer_text = True | |
| 356 | 356 | if disable_entities: | |
| 357 | 357 | def _forbid_entities(*_args, **_kwargs): | |
| 358 | - | raise expat.ExpatError("xmltodict.parse(): entities are disabled") | |
| 359 | - | ||
| 360 | - | def _forbid_entities_default(text): | |
| 361 | - | if not text: | |
| 362 | - | return | |
| 363 | - | stripped = text.lstrip() | |
| 364 | - | if stripped.startswith('<!--'): | |
| 365 | - | return | |
| 366 | - | if stripped.startswith('<!') or stripped.startswith('&'): | |
| 367 | - | _forbid_entities() | |
| 358 | + | raise ValueError("entities are disabled") | |
| 368 | 359 | ||
| 369 | - | # Reject DTD/entity constructs explicitly instead of ignoring them. | |
| 370 | - | parser.DefaultHandler = _forbid_entities_default | |
| 371 | 360 | parser.EntityDeclHandler = _forbid_entities | |
| 372 | - | parser.StartDoctypeDeclHandler = _forbid_entities | |
| 373 | - | parser.ExternalEntityRefHandler = _forbid_entities | |
| 374 | 361 | if hasattr(xml_input, 'read'): | |
| 375 | 362 | parser.ParseFile(xml_input) | |
| 376 | 363 | elif isgenerator(xml_input): |
The check that tells the two apart
fail→pass·tests/test_xmltodict.py::test_disable_entities_true_allows_doctype_without_entities
fail→pass·tests/test_xmltodict.py::test_external_entity
fail→pass·tests/test_xmltodict.py::test_external_entity_with_custom_expat
Check file tests/test_xmltodict.py, taken without changes from the fix and copied onto the older code, so the exact same check runs against both versions.
Origin and history
The code before ita2a9ab7e0692a62f64d97ff12553d0d53368c854
Broken version dated2025-09-16
Modulexmltodict
Units changedparse
Fingerprinte941e5834237e664
Checked2026-08-18 by goldset/0.1
Every field above is generated by our program. None of it is written by hand.
Other bugs found in martinblech/xmltodict
- 2026-02-15fix(unparse): serialize None text/attrs as empty values (fixes #401)
- 2025-09-16fix: fail closed when entities disabled
- 2025-09-16fix: validate XML comments
- 2025-09-12fix(unparse): handle non-string `#text` with attributes; unify value conversion
- 2025-09-12fix(unparse): skip empty lists to keep pretty/compact outputs consistent
- 2025-09-12fix(streaming): avoid parent accumulation at item_depth; add regression tests