Issue 30909: ServerProxy should not make requests with malformed XML (original) (raw)

https://docs.python.org/3.7/library/xmlrpc.client.html says:

""" When passing strings, characters special to XML such as <, >, and & will be automatically escaped. However, it’s the caller’s responsibility to ensure that the string is free of characters that aren’t allowed in XML, such as the control characters with ASCII values between 0 and 31 (except, of course, tab, newline and carriage return); failing to do this will result in an XML-RPC request that isn’t well-formed XML. If you have to pass arbitrary bytes via XML-RPC, use bytes or bytearray classes or the Binary wrapper class described below. """

The XML-RPC spec at http://xmlrpc.scripting.com/spec.html says:

""" What characters are allowed in strings? Non-printable characters? Null characters? Can a "string" be used to hold an arbitrary chunk of binary data?

Any characters are allowed in a string except < and &, which are encoded as < and &. A string can be used to encode binary data. """

I believe strings should be XML-escaped correctly or at the very least, an assertion should be made to ensure no malformed XML is ever generated.