Add warning to `xml.sax.saxutils.XMLGenerator` about untrusted inputs

[sethmlarson]

The xml.sax.saxutils.XMLGenerator class doesn't warn users that inputs are not validated and therefore validation, if required due to untrusted input, is the user responsibility.

Linked PRs

• gh-139478: Add warning about lack of validation for xml.sax.saxutils.XMLGenerator #139479

[serhiy-storchaka]

I do not think that placing such loud warning before the class description is a good idea.

First, the purpose of this class is to reproduce the equivalent XML document from the sequence of SAX events. SAX events produced by the XML parser do not need validation. Any other use of this class is not intended use.

If add any note, it should be after the class description. And I doubt about the use of the warning directive, it should be reserved for more serious cases. The note directive or the plain text should be enough. Be careful not to add incorrect signal about the intended use of XMLGenerator.

Second, there is a larger elephant in the room. There are several other XML generators in the stdlib: minidom, ElementTree, xmlrpc, plistlib, libregrtest, maybe more. And almost no one of them validate the user data, even if they are purposed to be used with arbitrary user data (unlike to XMLGenerator).

[sethmlarson]

First, the purpose of this class is to reproduce the equivalent XML document from the sequence of SAX events. SAX events produced by the XML parser do not need validation. Any other use of this class is not intended use.

This seems like a good reason to modify the warning (and change it to a note). If you have specifics you can propose them in the pull request, otherwise I'll try my best.

Second, there is a larger elephant in the room. There are several other XML generators in the stdlib: minidom, ElementTree, xmlrpc, plistlib, libregrtest, maybe more. And almost no one of them validate the user data, even if they are purposed to be used with arbitrary user data (unlike to XMLGenerator).

If arbitrary user data is being processed then someone needs to do the validation. If we intend that someone to be the user, and it's probable that a user might mistakenly think we're doing the validation when we're not, then we should be documenting that fact somewhere.

[sethmlarson]

@serhiy-storchaka It does seem that the xml.sax module globally references the "XML Security" documentation page: https://docs.python.org/3/library/xml.html#xml-security

[serhiy-storchaka]

I suggest to look at global picture. What other modules have such issue? Then we should add standardized notes/warnings for all modules.

Even if use of XMLGenerator for XML generation is not intended, people use it for this (at least one case), so it makes sense to add such note/warning here too. But only after other modules.

cc @vstinner which added a workaround for similar issue in regrtest (#121188).