Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
loxun is a Python module to write large output in XML using Unicode and namespaces. Of course you can also use it for small XML output with plain 8 bit strings and no namespaces.
loxun's features are:
small memory foot print: the document is created on the fly by writing to an output stream, no need to keep all of it in memory.
easy to use namespaces: simply add a namespace and refer to it using the
standard namespace:tag
syntax.
mix unicode and io.BytesIO: pass both unicode or plain 8 bit strings to any
of the methods. Internally loxun converts them to unicode, so once a
parameter got accepted by the API you can rely on it not causing any
messy UnicodeError
trouble.
automatic escaping: no need to manually handle special characters such
as <
or &
when writing text and attribute values.
robustness: while you write the document, sanity checks are performed on
everything you do. Many silly mistakes immediately result in an
XmlError
, for example missing end elements or references to undeclared
namespaces.
open source: distributed under the GNU Lesser General Public License 3 or later.
Here is a very basic example. First you have to create an output stream. In
many cases this would be a file, but for the sake of simplicity we use a
io.BytesIO
here:
>>> from __future__ import unicode_literals
>>> import io
>>> out = io.BytesIO()
Then you can create an XmlWriter
to write to this output:
>>> xml = XmlWriter(out)
Now write the content:
>>> xml.addNamespace("xhtml", "http://www.w3.org/1999/xhtml")
>>> xml.startTag("xhtml:html")
>>> xml.startTag("xhtml:body")
>>> xml.text("Hello world!")
>>> xml.tag("xhtml:img", {"src": "smile.png", "alt": ":-)"})
>>> xml.endTag()
>>> xml.endTag()
>>> xml.close()
And the result is:
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<xhtml:html xmlns:xhtml="http://www.w3.org/1999/xhtml">
<xhtml:body>
Hello world!
<xhtml:img alt=":-)" src="smile.png" />
</xhtml:body>
</xhtml:html>
The following example creates a very simple XHTML document.
To make it simple, the output goes to a BytesIO
, but you could also use
a binary file that has been created using io.open(filename, "wb")
.
>>> from __future__ import unicode_literals
>>> import io
>>> out = io.BytesIO()
First create an XmlWriter
to write the XML code to the specified output:
>>> xml = XmlWriter(out)
This automatically adds the XML prolog:
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
Next add the <html>
start tag:
>>> xml.startTag("html")
Now comes the . To pass attributes, specify them in a dictionary. So in order to add::
<body id="top">
use:
>>> xml.startTag("body", {"id": "top"})
Let' add a little text so there is something to look at:
>>> xml.text("Hello world!")
Wrap it up: close all elements and the document.
>>> xml.endTag()
>>> xml.endTag()
>>> xml.close()
And this is what we get:
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<html>
<body id="top">
Hello world!
</body>
</html>
Specifying attributes
First create a writer:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out)
Now write the content:
>>> xml.tag("img", {"src": "smile.png", "alt": ":-)"})
Attribute values do not have to be strings, other types will be converted to
Unicode using Python's unicode()
function:
>>> xml.tag("img", {"src": "wink.png", "alt": ";-)", "width": 32, "height": 24})
And the result is:
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<img alt=":-)" src="smile.png" />
<img alt=";-)" height="24" src="wink.png" width="32" />
Now the same thing but with a namespace. First create the prolog and header like above:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out)
Next add the namespace:
>>> xml.addNamespace("xhtml", "http://www.w3.org/1999/xhtml")
Now elements can use qualified tag names using a colon (:) to separate namespace and tag name:
>>> xml.startTag("xhtml:html")
>>> xml.startTag("xhtml:body")
>>> xml.text("Hello world!")
>>> xml.endTag()
>>> xml.endTag()
>>> xml.close()
As a result, tag names are now prefixed with "xhtml:":
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<xhtml:html xmlns:xhtml="http://www.w3.org/1999/xhtml">
<xhtml:body>
Hello world!
</xhtml:body>
</xhtml:html>
Sometimes you want to use characters outside the ASCII range, for example German Umlauts, the Euro symbol or Japanese Kanji. The easiest and performance wise best way is to use Unicode strings. For example:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, prolog=False)
>>> xml.text(u"The price is \u20ac 100") # Unicode of Euro symbol
>>> out.getvalue().rstrip("\r\n")
'The price is \xe2\x82\xac 100'
Notice the "u" before the string passed to XmlWriter.text()
, it declares the
string to be a unicode string that can hold any character, even those that are
beyond the 8 bit range.
Also notice that in the output the Euro symbol looks very different from the
input. This is because the output encoding is UTF-8 (the default), which
has the advantage of keeping all ASCII characters the same and turning any
characters with a code of 128 or more into a sequence of 8 bit bytes that
can easily fit into an output stream to a binary file or io.BytesIO
.
If you have to stick to classic 8 bit string parameters, loxun attempts to convert them to unicode. By default it assumes ASCII encoding, which does not work out as soon as you use a character outside the ASCII range:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, prolog=False)
>>> xml.text("The price is \xa4 100") # ISO-8859-15 code of Euro symbol
Traceback (most recent call last):
...
UnicodeDecodeError: 'ascii' codec can't decode byte 0xa4 in position 13: ordinal not in range(128)
In this case you have to tell the writer the encoding you use by specifying
the the sourceEncoding
:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, prolog=False, sourceEncoding="iso-8859-15")
Now everything works out again:
>>> xml.text("The price is \xa4 100") # ISO-8859-15 code of Euro symbol
>>> out.getvalue().rstrip("\r\n")
'The price is \xe2\x82\xac 100'
Of course in practice you will not mess around with hex codes to pass your
texts. Instead you just specify the source encoding using the mechanisms
described in PEP 263,
Defining Python Source Code Encodings <http://www.python.org/dev/peps/pep-0263/>
_.
By default, loxun starts a new line for each startTag
and indents the
content with two spaces. You can change the spaces to any number of spaces and
tabs you like:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, indent=" ") # <-- Indent with 4 spaces.
>>> xml.startTag("html")
>>> xml.startTag("body")
>>> xml.text("Hello world!")
>>> xml.endTag()
>>> xml.endTag()
>>> xml.close()
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<html>
<body>
Hello world!
</body>
</html>
You can disable pretty printing all together using pretty=False
, resulting
in an output of a single large line:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, pretty=False) # <-- Disable pretty printing.
>>> xml.startTag("html")
>>> xml.startTag("body")
>>> xml.text("Hello world!")
>>> xml.endTag()
>>> xml.endTag()
>>> xml.close()
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?><html><body>Hello world!</body></html>
When you create a writer, it automatically write an XML prolog processing instruction to the output. This is what the default prolog looks like:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out)
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
You can change the version or encoding:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, encoding=u"ascii", version=u"1.1")
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.1" encoding="ascii"?>
To completely omit the prolog, set the parameter prolog=False
:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out, prolog=False)
>>> out.getvalue()
''
Apart from text and tags, XML provides a few more things you can add to documents. Here's an example that shows how to do it with loxun.
First, create a writer:
>>> import io
>>> out = io.BytesIO()
>>> xml = XmlWriter(out)
Let's add a document type definition:
>>> xml.raw("<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" SYSTEM \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">")
>>> xml.newline()
Notice that loxun uses the generic XmlWriter.raw()
for that, which allows to
add any content without validation or escaping. You can do all sorts of nasty
things with raw()
that will result in invalid XML, but this is one of its
reasonable uses.
Next, let's add a comment:
>>> xml.comment("Show case some rarely used XML constructs")
Here is a processing instruction:
>>> xml.processingInstruction("xml-stylesheet", "href=\"default.css\" type=\"text/css\"")
And finally a CDATA section:
>>> xml.cdata(">> this will not be parsed <<")
And the result is:
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" SYSTEM "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!-- Show case some rarely used XML constructs -->
<?xml-stylesheet href="default.css" type="text/css"?>
<![CDATA[>> this will not be parsed <<]]>
Loxun automatically optimized pairs of empty start/end tags. For example:
>>> out = io.BytesIO()
>>> xml = XmlWriter(out)
>>> xml.startTag("customers")
>>> xml.startTag("person", {"id": "12345", "name": "Doe, John"})
>>> xml.endTag("person") # without optimization, this would add </person>.
>>> xml.endTag()
>>> xml.close()
>>> print out.getvalue().rstrip("\r\n")
<?xml version="1.0" encoding="utf-8"?>
<customers>
<person id="12345" name="Doe, John" />
</customers>
Despite the explicit startTag("person")
and matching endtag()
, the
output only contains a simple <person ... />
tag.
If you want to help improve loxun, you can access the source code at http://github.com/roskakori/loxun.
Currently loxun does what it was built for.
There are is no real plans to improve it in the near future, but here is a list of features that might be added at some point:
XmlError
when namespaces are added with attributes instead of
XmlWriter.addNamespace()
.XmlWriter
would get a property logger
which is a standard
logging.Logger
. By default it could log original exceptions that
loxun turns into an XmlError
and namespaces opened and closed.
Changing it to logging.DEBUG
would log each tag and XML construct
written, including additional information about the internal tag stack.
That way you could dynamically increase or decrease logging output.XmlWriter
, it could be a optional parameter for
XmlWriter.startTag()
where it could be turned on and off as needed. And
the property could be named literal
instead of pretty
(with an
inverse logic).DomWriter
that creates a xml.dom.minidom.Document
.Some features other XML libraries support but I never saw any real use for:
Version 2.0, 2014-07-28
Stefan Schwarzer
_ who offered his
guidance during a "Python 2 to 3" sprint at EuroPython 2014)... _Stefan Schwarzer: http://www.sschwarzer.net
Version 1.3, 2012-01-01
endTags()
to close several or all open tags (issue #3,
contributed by Anton Kolechkin).ChainXmlWriter
which is similar to XmlWriter
and allows to
chain methods for more concise source code (issue #3, contributed by Anton
Kolechkin).Version 1.2, 2011-03-12
AttributeError
when XmlWriter(..., encoding=...)
was set.Version 1.1, 08-Jan-2011
AssertionError
when pretty
was set to False
(issue #1; fixed by David Cramer).Version 1.0, 11-Oct-2010
with
so you don not have to manually call
XmlWriter.close()
anymore.Version 0.8, 11-Jul-2010
XmlWriter.startTag()
and
XmlWriter.tag()
with values that have other types than str
or
unicode
. When written to XML, the value is converted using Python's
built-in unicode()
function.Version 0.7, 03-Jul-2010
x.startTag("some"); x.endTag()
results in
<some />
instead of <some></some>
.XmlError
instead
of ValueError
.Version 0.6, 03-Jun-2010
indent
to specify the indentation text each new line starts with.newline
to specify how lines written should end.XmlWriter.tag()
did not remove namespaces declared immediately
before it.Version 0.5, 25-May-2010
XmlWriter.tag()
which resulted
in an XmlError
.Version 0.4, 21-May-2010
sourceEncoding
to simplify processing of classic strings.
The manual section "Working with non ASCII characters" explains how to use
it.Version 0.3, 17-May-2010
XmlWriter.endTag()
.text()
to normalize newlines and white space if pretty printing
is enabled.XmlWriter.prolog()
. To omit the prolog, specify prolog=False
when
creating the XmlWriter
. If you later want to write the prolog yourself,
use XmlWriter.processingInstruction()
.*Element()
to *Tag
because they really only write tags, not
whole elements.Version 0.2, 16-May-2010
XmlWriter.comment()
, XmlWriter.cdata()
and
XmlWriter.processingInstruction()
to write these specific XML constructs.Version 0.1, 15-May-2010
FAQs
large output in XML using unicode and namespaces
We found that loxun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.