xml.sax.saxutils.escape doesn't escape multiple characters safely

[tylerjohnhughes]

BPO	27429
Nosy	@vadmium, @serhiy-storchaka, @zhangyangyu, @tylerjohnhughes
Files	escapetest.py: Behavior Example issue27429.patch sax_escape_doc.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2016-06-30.23:28:04.390>
labels = ['expert-XML', 'type-feature', 'docs']
title = "xml.sax.saxutils.escape doesn't escape multiple characters safely"
updated_at = <Date 2016-07-03.14:17:00.767>
user = 'https://github.com/tylerjohnhughes'

bugs.python.org fields:

activity = <Date 2016-07-03.14:17:00.767>
actor = 'xiang.zhang'
assignee = 'docs@python'
closed = False
closed_date = None
closer = None
components = ['Documentation', 'XML']
creation = <Date 2016-06-30.23:28:04.390>
creator = 'tylerjohnhughes'
dependencies = []
files = ['43594', '43616', '43617']
hgrepos = []
issue_num = 27429
keywords = ['patch']
message_count = 5.0
messages = ['269634', '269763', '269766', '269767', '269768']
nosy_count = 5.0
nosy_names = ['docs@python', 'martin.panter', 'serhiy.storchaka', 'xiang.zhang', 'tylerjohnhughes']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue27429'
versions = ['Python 3.5']

[tylerjohnhughes]

The escape function appears to go through the list in multiple passes, replacing characters as it encounters them on each pass, rather than traversing the source string and replacing matches in the entities dict. This results in invalid escape strings if a replacement value contains one of the replacement entities. I've attached a file to reproduce the behavior.

[zhangyangyu]

I think this a bug. There should be no override when escape or unescape. Upload a patch to fix this.

[serhiy-storchaka]

The purpose of xml.sax.saxutils.escape() is escaping characters, that can't be used directly in XML: "&", "<", etc. Quotes are escaped in attributes. It shouldn't be used for replacing ";", because this character itself is used in escapes.

There is no a bug. If use this function correctly it works as expected.

[zhangyangyu]

I thought of that too. But the doc doesn't tell you that you can not put any characters in the entities, so I think we should make the implementation right when some unexpected characters are passed in. If you don't like the implementation to be changed, I think at least we should declare that in the documentation.

[zhangyangyu]

Put a not in escape's doc.

[nanjekyejoannah]

Associated PR has been merged.