René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add utility functions to test for legal XML characters and names","articleBody":"# Feature or enhancement\n\nIt is well known fact that some characters (such as `\u003c` or `\u0026`) must be escaped in XML and HTML, and that attribute values must be quoted. It is less known fact (unless you specially looked for it) that not all characters can be included in XML, even if escaped. For example, XML cannot contain the null character.\n\nThere is also restriction on names of elements and attributes. They cannot contain `\u003c`, `\u003e`, `/`, `!`, `?`, spaces and many other characters. But unlike to Python identifiers, `-`, `:`, `.`, etc are acceptable. The list of valid and invalid characters is pretty long. In the case when the user input is used for element or attribute names without validation, this can even lead to XML injection vulnerability ([CVE-2025-9375](https://nvd.nist.gov/vuln/detail/CVE-2025-9375))\n\nSo, I think that it would be useful to provide standard functions to validate XML characters and names in the stdlib. `xml.sax.saxutils` looks an appropriate place, it already has `escape()` and `quoteattr()` utilities.\n\nWe can also provide functions to \"sanitize\" XML characters, similar to `sanitize_xml()` in `Lib/test/libregrtest/utils.py`, but more general. This is similar to old issue #63014.\n\nNow, the problem is that there are two standards of XML: 1.0 and 1.1. The former is much more popular. And they have different definitions of legal characters. There are also restricted characters in XML 1.1 which cannot be used in \"well-formed\" documents and parsed entities. There is also a set of characters (version depending) using which legal but is discouraged. Should we have several functions or several parameters to specify the XML version and other options?\n\nhttps://www.w3.org/TR/xml/#charsets\nhttps://www.w3.org/TR/xml11/#charsets\n\nFortunately, the syntax for names is the same in XML 1.0 and 1.1.\n\nhttps://www.w3.org/TR/xml/#NT-Name\nhttps://www.w3.org/TR/xml11/#NT-Name\n\nWe can also add a similar set of functions for HTML.\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-139768\n* gh-149412\n* gh-149641\n* gh-149652\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/serhiy-storchaka","@type":"Person","name":"serhiy-storchaka"},"datePublished":"2025-10-02T08:44:00.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/139489/cpython/issues/139489"}