Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
.. image:: https://travis-ci.org/Shoobx/xmldiff.svg?branch=master :target: https://travis-ci.org/Shoobx/xmldiff
.. image:: https://coveralls.io/repos/github/Shoobx/xmldiff/badge.svg :target: https://coveralls.io/github/Shoobx/xmldiff
xmldiff
is a library and a command-line utility for making diffs out of XML.
This may seem like something that doesn't need a dedicated utility,
but change detection in hierarchical data is very different from change detection in flat data.
XML type formats are also not only used for computer readable data,
it is also often used as a format for hierarchical data that can be rendered into human readable formats.
A traditional diff on such a format would tell you line by line the differences,
but this would not be be readable by a human.
xmldiff
provides tools to make human readable diffs in those situations.
Full documentation is on xmldiff.readthedocs.io <https://xmldiff.readthedocs.io>
_
xmldiff
is still under rapid development,
and no guarantees are done that the output of one version will be the same as the output of any previous version.
xmldiff
is both a command-line tool and a Python library.
To use it from the command-line, just run xmldiff
with two input files::
$ xmldiff file1.xml file2.xml
There is also a command to patch a file with the output from the xmldiff
command::
$ xmlpatch file.diff file1.xml
There is a simple API for using xmldiff
as a library::
from lxml import etree from xmldiff import main, formatting
diff = main.diff_files('file1.xml', 'file2.xml', formatter=formatting.XMLFormatter())
There is also a method diff_trees()
that take two lxml trees,
and a method diff_texts()
that will take strings containing XML.
Similarly, there is patch_file()
patch_text()
and patch_tree()
::
result = main.patch_file('file.diff', 'file1.xml')
xmldiff
0.6/1.xA complete, ground up, pure-Python rewrite
Easier to maintain, the code is less complex and more Pythonic, and uses more custom classes instead of just nesting lists and dicts.
Fixes the problems with certain large files and solves the memory leaks.
A nice, easy to use Python API for using it as a library.
Adds support for showing the diffs in different formats, mainly one where differences are marked up in the XML, useful for making human readable diffs.
These formats can show text differences in a semantically meaningful way.
An output format compatible with 0.6/1.x is also available.
2.0 is currently significantly slower than xmldiff
0.6/1.x,
but this will change in the future.
Currently we make no effort to make xmldiff
2.0 fast,
we concentrate on making it correct and usable.
Lennart Regebro, regebro@gmail.com (main author)
Stephan Richter, srichter@shoobx.com
Albertas Agejevas, alga@shoobx.com
Greg Kempe, greg@laws.africa
Filip Demski, glamhoth@protonmail.com
Jacek Chałupka, krunchfrompoland@gmail.com
Thomas Pfitzinger, thpfitzinger@web.de
The diff algorithm is based on
"Change Detection in Hierarchically Structured Information <http://infolab.stanford.edu/c3/papers/html/tdiff3-8/tdiff3-8.html>
_",
and the text diff is using Google's diff_match_patch
algorithm.
Changed the comparison to make accurate and standard more accurate, although fast gets less accurate as a result.
Changed usage of deprecated pkg_resources
package to importlib.metadata
.
A use_replace
flag was added to the XMLFormatter
by Thomas Pfitzinger.
It changes text replacement from delete and insert tags to a replace tag.
It's not currently accessaible thtough the CLI, the question is it is better
to add a new formatter name, or an option to pass in formatter flags.
InsertNamespace
and DeleteNamespace
actions for better handling
of changing namespaces. Should improve any "Unknown namespace prefix"
errors. Changing the URI of a a namespace prefix is not supported, and will
raise an error.Used geometric mean for the node_ratio, for better handling of simple nodes.
Added an experimental --best-match method that is slower, but generate smaller diffs when you have many nodes that are similar.
The -F argument now also affects the --fast-match stage.
Make it possible to adjust the attributes considered when comparing nodes.
Python versions 3.7 to 3.11 are now supported.
Improved node matching method, that puts more emphasis similarities than differences when weighing attributes vs children.
Added a parameter to return error code 1 when there are differences between the files
Added a parameter for ignoring attributes in comparison.
Solved a bug in xmlpatch in certain namespace situations.
Added a --diff-encoding parameter to xmlpatch, to support diff-files that are not in your system default encoding.
Added a simple xmlpatch
command and API.
Multiple updates to documentation and code style
Changed the substitution unicode character area to use the Private Use Area in BMP(0), to support narrow Python builds
Added --unique-attributes argument.
Added options for faster node comparisons. The "middle" option is now default, it had very few changes in matches, but is much faster.
Implemented a Fast Match algorithm for even faster diffing.
Speed improvements through caching
Fixed a bug where MoveNode actions sometimes was in the wrong order
Added an InsertComment action, as comments require different handling, so it's easier to deal with them this way. You can still use DeleteNode and UpdateTextIn for them with no special handling.
When renaming tags the XMLFormatter will mark them with "diff:rename" instead of making a new tag and deleting the old.
Tags will now be moved first, and updated and renamed later, as the new tag name or attributes might not be valid in the old location.
A complete, bottom-up, pure-python rewrite
New easy API
100% test coverage
New output formats:
A new default output format with new actions
A format intended to be parseable by anyone parsing the old format.
XML with changes marked though tags and attributes
xmldiff 2.0 is significantly slower than xmldiff 0.6 or 1.0, the emphasis so far is on correctness, not speed.
FAQs
Creates diffs of XML files
We found that xmldiff demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.