
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Help module to parse a simple XML buffer and store it as a read-only (mostly) dictionary-type object (MyXml). This dictionary can hold other dictionaries, nodes-lists, or leaf nodes. Access to the nodes is by using attributes.
xml = parse("Val") xml.Foo.Bar == "Val" True xml.Foo.Bar Val
I don't like to use the built in Python DOM parsers for simple XML data, but this module is good only for simple XML! No name-spaces, CDATA and other fancy features are supported.
There are three factory functions, "parse", "parse_file" and "parse_object".
parse takes an XML string and builds MyXml object from it.
parse_file takes a file name reads it and do the same.
Both functions take an optional list of tags names from the beginning of the XML data, to ignore.
It is possible, but not convenient, to construct an XML trees using this module.
Usage Examples:
xml = parse(''' ... <?xml bla bla bla> ... ...
... One Two & Three ... ... ... ... ... Bla Bla Bla ... ... No ... Value ... ... ''')
xml.Main.Text One Two & Three
xml.Main.Text == "One Two & Three" True
xml.Main.Text.value == "One Two & Three" True
There is also a way to access a node with "nd_" prefix (so we can access python reserved words), this will also return EMPY_NODE if the node doesn't exists.
xml.nd_Main.nd_Text One Two & Three
xml.Main.Double.Double[0] is xml.Main.Double.Double True
len(xml.Main.List.Item) 3 unicode(xml.Main.List.Item[2]) u'Bla Bla Bla'
xml["Main"]["Text"] == xml.Main["Text"] True xml.Main.get("Text") == xml["Main"].Text True
xml.xpath("Main/List/Item")[2] Bla Bla Bla
xml.Main.List.Item[1].at_ccc u'ab+c'
xml.Main.List.Item[0].at_dict["aaa"] u'bbb'
xml.Main.BoolNum.boolean False
xml.Main.BoolNum.at_num.number * 2 7.0 xml.xpath("Main/BoolNum").at_bool.boolean True
xml.Main.List.Item[0].at_aaa.number
bool(xml.get("foo").boolean) False
xml.xpath("Main/foo").number is None True
Bla Bla Blaprint xml.Main.List
xml = parse_object({ ... "foo1": "bar", ... "foo2": ["bar1", "bar2", "bar3"], ... "foo3": {"bar": "foo"}, ... "foo4": 5 ... }, "Main") # "Main" is the name of the top most node
xml.xpath("Main/foo4").number 5
xml.xpath("Main/foo2/list")[1] == "bar2" True
add_returns_self = xml.add(MyNode("bar5", "foo5")) # MyNode(value, name) xml.foo5.at_dict["attr"] = "attr value" xml.xpath("Main/foo5").at_attr == "attr value" True
One can also use the other built in dictionary and list methods, but this is not recommended
5 bar bar1 bar2 bar3 foo bar5xml # Here the order is not preserved because of the python dictionary
Please note that this module is not efficient in parsing large XML buffers. It uses string slicing heavily.
Erez Bibi
Please send comments and questions to erezbibi AT users DOT sourceforge DOT net
FAQs
Easy to use parser for simple XML
We found that my_xml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.