XMLParser 物件¶

xmlparser 物件擁有以下方法：

xmlparser.Parse(data[,isfinal])¶

Parses the contents of the stringdata, calling the appropriate handlerfunctions to process the parsed data.isfinal must be true on the final callto this method; it allows the parsing of a single file in fragments,not the submission of multiple files.data can be the empty string at any time.

xmlparser.ParseFile(file)¶

Parse XML data reading from the objectfile.file only needs to providetheread(nbytes) method, returning the empty string when there's no moredata.

xmlparser.SetBase(base)¶

Sets the base to be used for resolving relative URIs in system identifiers indeclarations. Resolving relative identifiers is left to the application: thisvalue will be passed through as thebase argument to theExternalEntityRefHandler(),NotationDeclHandler(), andUnparsedEntityDeclHandler() functions.

xmlparser.GetBase()¶

Returns a string containing the base set by a previous call toSetBase(),orNone ifSetBase() hasn't been called.

xmlparser.GetInputContext()¶

Returns the input data that generated the current event as a string. The data isin the encoding of the entity which contains the text. When called while anevent handler is not active, the return value isNone.

xmlparser.ExternalEntityParserCreate(context[,encoding])¶

Create a "child" parser which can be used to parse an external parsed entityreferred to by content parsed by the parent parser. Thecontext parametershould be the string passed to theExternalEntityRefHandler() handlerfunction, described below. The child parser is created with theordered_attributes andspecified_attributes set to the values ofthis parser.

xmlparser.SetParamEntityParsing(flag)¶

Control parsing of parameter entities (including the external DTD subset).Possibleflag values areXML_PARAM_ENTITY_PARSING_NEVER,XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE andXML_PARAM_ENTITY_PARSING_ALWAYS. Return true if setting the flagwas successful.

xmlparser.UseForeignDTD([flag])¶

Calling this with a true value forflag (the default) will cause Expat to calltheExternalEntityRefHandler withNone for all arguments toallow an alternate DTD to be loaded. If the document does not contain adocument type declaration, theExternalEntityRefHandler will still becalled, but theStartDoctypeDeclHandler andEndDoctypeDeclHandler will not be called.

Passing a false value forflag will cancel a previous call that passed a truevalue, but otherwise has no effect.

This method can only be called before theParse() orParseFile()methods are called; calling it after either of those have been called causesExpatError to be raised with thecode attribute set toerrors.codes[errors.XML_ERROR_CANT_CHANGE_FEATURE_ONCE_PARSING].

xmlparser.SetReparseDeferralEnabled(enabled)¶

警告

CallingSetReparseDeferralEnabled(False) has security implications,as detailed below; please make sure to understand these consequencesprior to using theSetReparseDeferralEnabled method.

Expat 2.6.0 introduced a security mechanism called "reparse deferral"where instead of causing denial of service through quadratic runtimefrom reparsing large tokens, reparsing of unfinished tokens is now delayedby default until a sufficient amount of input is reached.Due to this delay, registered handlers may — depending of the sizing ofinput chunks pushed to Expat — no longer be called right after pushing newinput to the parser. Where immediate feedback and taking over responsibilityof protecting against denial of service from large tokens are both wanted,callingSetReparseDeferralEnabled(False) disables reparse deferralfor the current Expat parser instance, temporarily or altogether.CallingSetReparseDeferralEnabled(True) allows re-enabling reparsedeferral.

Note thatSetReparseDeferralEnabled() has been backported to someprior releases of CPython as a security fix. Check for availability ofSetReparseDeferralEnabled() usinghasattr() if used in coderunning across a variety of Python versions.

在 3.13 版被加入.

xmlparser.GetReparseDeferralEnabled()¶

Returns whether reparse deferral is currently enabled for the givenExpat parser instance.

在 3.13 版被加入.

xmlparser 物件擁有以下方法來減輕一些常見的 XML 漏洞。

xmlparser.SetAllocTrackerActivationThreshold(threshold,/)¶

Sets the number of allocated bytes of dynamic memory needed to activateprotection against disproportionate use of RAM.

By default, parser objects have an allocation activation threshold of 64 MiB,or equivalently 67,108,864 bytes.

AnExpatError is raised if this method is called on anon-root parser.The correspondinglineno andoffsetshould not be used as they may have no special meaning.

在 3.14.0 (unreleased) 版被加入.

xmlparser.SetAllocTrackerMaximumAmplification(max_factor,/)¶

Sets the maximum amplification factor between direct input and bytesof dynamic memory allocated.

The amplification factor is calculated asallocated/directwhile parsing, wheredirect is the number of bytes read fromthe primary document in parsing andallocated is the numberof bytes of dynamic memory allocated in the parser hierarchy.

Themax_factor value must be a non-NaNfloat value greater thanor equal to 1.0. Amplification factors greater than 100.0 can be observednear the start of parsing even with benign files in practice. In particular,the activation threshold should be carefully chosen to avoid false positives.

By default, parser objects have a maximum amplification factor of 100.0.

AnExpatError is raised if this method is called on anon-root parser or ifmax_factor is outside the valid range.The correspondinglineno andoffsetshould not be used as they may have no special meaning.

備註

The maximum amplification factor is only considered if the thresholdthat can be adjusted bySetAllocTrackerActivationThreshold()is exceeded.

在 3.14.0 (unreleased) 版被加入.

xmlparser 物件擁有以下屬性：

xmlparser.buffer_size¶

The size of the buffer used whenbuffer_text is true.A new buffer size can be set by assigning a new integer valueto this attribute.When the size is changed, the buffer will be flushed.

xmlparser.buffer_text¶

Setting this to true causes thexmlparser object to buffer textualcontent returned by Expat to avoid multiple calls to theCharacterDataHandler() callback whenever possible. This can improveperformance substantially since Expat normally breaks character data into chunksat every line ending. This attribute is false by default, and may be changed atany time. Note that when it is false, data that does not contain newlinesmay be chunked too.

xmlparser.buffer_used¶

Ifbuffer_text is enabled, the number of bytes stored in the buffer.These bytes represent UTF-8 encoded text. This attribute has no meaningfulinterpretation whenbuffer_text is false.

xmlparser.ordered_attributes¶

Setting this attribute to a non-zero integer causes the attributes to bereported as a list rather than a dictionary. The attributes are presented inthe order found in the document text. For each attribute, two list entries arepresented: the attribute name and the attribute value. (Older versions of thismodule also used this format.) By default, this attribute is false; it may bechanged at any time.

xmlparser.specified_attributes¶

If set to a non-zero integer, the parser will report only those attributes whichwere specified in the document instance and not those which were derived fromattribute declarations. Applications which set this need to be especiallycareful to use what additional information is available from the declarations asneeded to comply with the standards for the behavior of XML processors. Bydefault, this attribute is false; it may be changed at any time.

The following attributes contain values relating to the most recent errorencountered by anxmlparser object, and will only have correct valuesonce a call toParse() orParseFile() has raised anxml.parsers.expat.ExpatError exception.

xmlparser.ErrorByteIndex¶

Byte index at which an error occurred.

xmlparser.ErrorCode¶

Numeric code specifying the problem. This value can be passed to theErrorString() function, or compared to one of the constants defined in theerrors object.

xmlparser.ErrorColumnNumber¶

Column number at which an error occurred.

xmlparser.ErrorLineNumber¶

Line number at which an error occurred.

The following attributes contain values relating to the current parse locationin anxmlparser object. During a callback reporting a parse event theyindicate the location of the first of the sequence of characters that generatedthe event. When called outside of a callback, the position indicated will bejust past the last parse event (regardless of whether there was an associatedcallback).

xmlparser.CurrentByteIndex¶

Current byte index in the parser input.

xmlparser.CurrentColumnNumber¶

Current column number in the parser input.

xmlparser.CurrentLineNumber¶

Current line number in the parser input.

Here is the list of handlers that can be set. To set a handler on anxmlparser objecto, useo.handlername=func.handlername mustbe taken from the following list, andfunc must be a callable object acceptingthe correct number of arguments. The arguments are all strings, unlessotherwise stated.

xmlparser.XmlDeclHandler(version,encoding,standalone)¶

Called when the XML declaration is parsed. The XML declaration is the(optional) declaration of the applicable version of the XML recommendation, theencoding of the document text, and an optional "standalone" declaration.version andencoding will be strings, andstandalone will be1 if thedocument is declared standalone,0 if it is declared not to be standalone,or-1 if the standalone clause was omitted. This is only available withExpat version 1.95.0 or newer.

xmlparser.StartDoctypeDeclHandler(doctypeName,systemId,publicId,has_internal_subset)¶

Called when Expat begins parsing the document type declaration (<!DOCTYPE...). ThedoctypeName is provided exactly as presented. ThesystemId andpublicId parameters give the system and public identifiers if specified, orNone if omitted.has_internal_subset will be true if the documentcontains and internal document declaration subset. This requires Expat version1.2 or newer.

xmlparser.EndDoctypeDeclHandler()¶

Called when Expat is done parsing the document type declaration. This requiresExpat version 1.2 or newer.

xmlparser.ElementDeclHandler(name,model)¶

Called once for each element type declaration.name is the name of theelement type, andmodel is a representation of the content model.

xmlparser.AttlistDeclHandler(elname,attname,type,default,required)¶

Called for each declared attribute for an element type. If an attribute listdeclaration declares three attributes, this handler is called three times, oncefor each attribute.elname is the name of the element to which thedeclaration applies andattname is the name of the attribute declared. Theattribute type is a string passed astype; the possible values are'CDATA','ID','IDREF', ...default gives the default value forthe attribute used when the attribute is not specified by the document instance,orNone if there is no default value (#IMPLIED values). If theattribute is required to be given in the document instance,required will betrue. This requires Expat version 1.95.0 or newer.

xmlparser.StartElementHandler(name,attributes)¶

Called for the start of every element.name is a string containing theelement name, andattributes is the element attributes. Ifordered_attributes is true, this is a list (seeordered_attributes for a full description). Otherwise it's adictionary mapping names to values.

xmlparser.EndElementHandler(name)¶

Called for the end of every element.

xmlparser.ProcessingInstructionHandler(target,data)¶

Called for every processing instruction.

xmlparser.CharacterDataHandler(data)¶

Called for character data. This will be called for normal character data, CDATAmarked content, and ignorable whitespace. Applications which must distinguishthese cases can use theStartCdataSectionHandler,EndCdataSectionHandler, andElementDeclHandler callbacks tocollect the required information. Note that the character data may bechunked even if it is short and so you may receive more than one call toCharacterDataHandler(). Set thebuffer_text instance attributetoTrue to avoid that.

xmlparser.UnparsedEntityDeclHandler(entityName,base,systemId,publicId,notationName)¶

Called for unparsed (NDATA) entity declarations. This is only present forversion 1.2 of the Expat library; for more recent versions, useEntityDeclHandler instead. (The underlying function in the Expatlibrary has been declared obsolete.)

xmlparser.EntityDeclHandler(entityName,is_parameter_entity,value,base,systemId,publicId,notationName)¶

Called for all entity declarations. For parameter and internal entities,value will be a string giving the declared contents of the entity; this willbeNone for external entities. ThenotationName parameter will beNone for parsed entities, and the name of the notation for unparsedentities.is_parameter_entity will be true if the entity is a parameter entityor false for general entities (most applications only need to be concerned withgeneral entities). This is only available starting with version 1.95.0 of theExpat library.

xmlparser.NotationDeclHandler(notationName,base,systemId,publicId)¶

Called for notation declarations.notationName,base, andsystemId, andpublicId are strings if given. If the public identifier is omitted,publicId will beNone.

xmlparser.StartNamespaceDeclHandler(prefix,uri)¶

Called when an element contains a namespace declaration. Namespace declarationsare processed before theStartElementHandler is called for the elementon which declarations are placed.

xmlparser.EndNamespaceDeclHandler(prefix)¶

Called when the closing tag is reached for an element that contained anamespace declaration. This is called once for each namespace declaration onthe element in the reverse of the order for which theStartNamespaceDeclHandler was called to indicate the start of eachnamespace declaration's scope. Calls to this handler are made after thecorrespondingEndElementHandler for the end of the element.

xmlparser.CommentHandler(data)¶

Called for comments.data is the text of the comment, excluding the leading'<!--' and trailing'-->'.

xmlparser.StartCdataSectionHandler()¶

Called at the start of a CDATA section. This andEndCdataSectionHandlerare needed to be able to identify the syntactical start and end for CDATAsections.

xmlparser.EndCdataSectionHandler()¶

在 CDATA 區塊結束時呼叫。

xmlparser.DefaultHandler(data)¶

Called for any characters in the XML document for which no applicable handlerhas been specified. This means characters that are part of a construct whichcould be reported, but for which no handler has been supplied.

xmlparser.DefaultHandlerExpand(data)¶

This is the same as theDefaultHandler(), but doesn't inhibit expansionof internal entities. The entity reference will not be passed to the defaulthandler.

xmlparser.NotStandaloneHandler()¶

Called if the XML document hasn't been declared as being a standalone document.This happens when there is an external subset or a reference to a parameterentity, but the XML declaration does not set standalone toyes in an XMLdeclaration. If this handler returns0, then the parser will raise anXML_ERROR_NOT_STANDALONE error. If this handler is not set, noexception is raised by the parser for this condition.

xmlparser.ExternalEntityRefHandler(context,base,systemId,publicId)¶

警告

Implementing a handler that accesses local files and/or the networkmay create a vulnerability toexternal entity attacksifxmlparser is used with user-provided XML content.Please reflect on yourthreat modelbefore implementing this handler.

Called for references to external entities.base is the current base, as setby a previous call toSetBase(). The public and system identifiers,systemId andpublicId, are strings if given; if the public identifier is notgiven,publicId will beNone. Thecontext value is opaque and shouldonly be used as described below.

For external entities to be parsed, this handler must be implemented. It isresponsible for creating the sub-parser usingExternalEntityParserCreate(context), initializing it with the appropriatecallbacks, and parsing the entity. This handler should return an integer; if itreturns0, the parser will raise anXML_ERROR_EXTERNAL_ENTITY_HANDLING error, otherwise parsing willcontinue.

If this handler is not provided, external entities are reported by theDefaultHandler callback, if provided.

ExpatError 例外¶

ExpatError exceptions have a number of interesting attributes:

ExpatError.code¶

Expat's internal error number for the specific error. Theerrors.messages dictionary mapsthese error numbers to Expat's error messages. For example:

fromxml.parsers.expatimportParserCreate,ExpatError,errorsp=ParserCreate()try:p.Parse(some_xml_document)exceptExpatErroraserr:print("Error:",errors.messages[err.code])

Theerrors module also provides error messageconstants and a dictionarycodes mappingthese messages back to the error codes, see below.

ExpatError.lineno¶

Line number on which the error was detected. The first line is numbered1.

ExpatError.offset¶

Character offset into the line where the error occurred. The first column isnumbered0.

範例¶

The following program defines three handlers that just print out theirarguments.

importxml.parsers.expat# 3 handler functionsdefstart_element(name,attrs):print('Start element:',name,attrs)defend_element(name):print('End element:',name)defchar_data(data):print('Character data:',repr(data))p=xml.parsers.expat.ParserCreate()p.StartElementHandler=start_elementp.EndElementHandler=end_elementp.CharacterDataHandler=char_datap.Parse("""<?xml version="1.0"?><parent id="top"><child1 name="paul">Text goes here</child1><child2 name="fred">More text</child2></parent>""",1)

這個程式的輸出是：

Startelement:parent{'id':'top'}Startelement:child1{'name':'paul'}Characterdata:'Text goes here'Endelement:child1Characterdata:'\n'Startelement:child2{'name':'fred'}Characterdata:'More text'Endelement:child2Characterdata:'\n'Endelement:parent

Content Model Descriptions¶

Content models are described using nested tuples. Each tuple contains fourvalues: the type, the quantifier, the name, and a tuple of children. Childrenare simply additional content model descriptions.

The values of the first two fields are constants defined in thexml.parsers.expat.model module. These constants can be collected in twogroups: the model type group and the quantifier group.

The constants in the model type group are:

xml.parsers.expat.model.XML_CTYPE_ANY

The element named by the model name was declared to have a content model ofANY.

xml.parsers.expat.model.XML_CTYPE_CHOICE

The named element allows a choice from a number of options; this is used forcontent models such as(A|B|C).

xml.parsers.expat.model.XML_CTYPE_EMPTY

Elements which are declared to beEMPTY have this model type.

xml.parsers.expat.model.XML_CTYPE_MIXED

xml.parsers.expat.model.XML_CTYPE_NAME

xml.parsers.expat.model.XML_CTYPE_SEQ

Models which represent a series of models which follow one after the other areindicated with this model type. This is used for models such as(A,B,C).

The constants in the quantifier group are:

xml.parsers.expat.model.XML_CQUANT_NONE

No modifier is given, so it can appear exactly once, as forA.

xml.parsers.expat.model.XML_CQUANT_OPT

The model is optional: it can appear once or not at all, as forA?.

xml.parsers.expat.model.XML_CQUANT_PLUS

The model must occur one or more times (likeA+).

xml.parsers.expat.model.XML_CQUANT_REP

The model must occur zero or more times, as forA*.

Expat 錯誤常數¶

The following constants are provided in thexml.parsers.expat.errorsmodule. These constants are useful in interpreting some of the attributes oftheExpatError exception objects raised when an error has occurred.Since for backwards compatibility reasons, the constants' value is the errormessage and not the numeric errorcode, you do this by comparing itscode attribute witherrors.codes[errors.XML_ERROR_CONSTANT_NAME].

errors 模組有以下屬性：

xml.parsers.expat.errors.codes¶

A dictionary mapping string descriptions to their error codes.

在 3.2 版被加入.

xml.parsers.expat.errors.messages¶

A dictionary mapping numeric error codes to their string descriptions.

在 3.2 版被加入.

xml.parsers.expat.errors.XML_ERROR_ASYNC_ENTITY¶

xml.parsers.expat.errors.XML_ERROR_ATTRIBUTE_EXTERNAL_ENTITY_REF¶

An entity reference in an attribute value referred to an external entity insteadof an internal entity.

xml.parsers.expat.errors.XML_ERROR_BAD_CHAR_REF¶

A character reference referred to a character which is illegal in XML (forexample, character0, or '�').

xml.parsers.expat.errors.XML_ERROR_BINARY_ENTITY_REF¶

An entity reference referred to an entity which was declared with a notation, socannot be parsed.

xml.parsers.expat.errors.XML_ERROR_DUPLICATE_ATTRIBUTE¶

An attribute was used more than once in a start tag.

xml.parsers.expat.errors.XML_ERROR_INCORRECT_ENCODING¶

xml.parsers.expat.errors.XML_ERROR_INVALID_TOKEN¶

Raised when an input byte could not properly be assigned to a character; forexample, a NUL byte (value0) in a UTF-8 input stream.

xml.parsers.expat.errors.XML_ERROR_JUNK_AFTER_DOC_ELEMENT¶

Something other than whitespace occurred after the document element.

xml.parsers.expat.errors.XML_ERROR_MISPLACED_XML_PI¶

An XML declaration was found somewhere other than the start of the input data.

xml.parsers.expat.errors.XML_ERROR_NO_ELEMENTS¶

The document contains no elements (XML requires all documents to contain exactlyone top-level element)..

xml.parsers.expat.errors.XML_ERROR_NO_MEMORY¶

Expat was not able to allocate memory internally.

xml.parsers.expat.errors.XML_ERROR_PARAM_ENTITY_REF¶

A parameter entity reference was found where it was not allowed.

xml.parsers.expat.errors.XML_ERROR_PARTIAL_CHAR¶

An incomplete character was found in the input.

xml.parsers.expat.errors.XML_ERROR_RECURSIVE_ENTITY_REF¶

An entity reference contained another reference to the same entity; possibly viaa different name, and possibly indirectly.

xml.parsers.expat.errors.XML_ERROR_SYNTAX¶

Some unspecified syntax error was encountered.

xml.parsers.expat.errors.XML_ERROR_TAG_MISMATCH¶

An end tag did not match the innermost open start tag.

xml.parsers.expat.errors.XML_ERROR_UNCLOSED_TOKEN¶

Some token (such as a start tag) was not closed before the end of the stream orthe next token was encountered.

xml.parsers.expat.errors.XML_ERROR_UNDEFINED_ENTITY¶

A reference was made to an entity which was not defined.

xml.parsers.expat.errors.XML_ERROR_UNKNOWN_ENCODING¶

The document encoding is not supported by Expat.

xml.parsers.expat.errors.XML_ERROR_UNCLOSED_CDATA_SECTION¶

以 CDATA 標記的區塊未被關閉。

xml.parsers.expat.errors.XML_ERROR_EXTERNAL_ENTITY_HANDLING¶

xml.parsers.expat.errors.XML_ERROR_NOT_STANDALONE¶

The parser determined that the document was not "standalone" though it declareditself to be in the XML declaration, and theNotStandaloneHandler wasset and returned0.

xml.parsers.expat.errors.XML_ERROR_UNEXPECTED_STATE¶

xml.parsers.expat.errors.XML_ERROR_ENTITY_DECLARED_IN_PE¶

xml.parsers.expat.errors.XML_ERROR_FEATURE_REQUIRES_XML_DTD¶

An operation was requested that requires DTD support to be compiled in, butExpat was configured without DTD support. This should never be reported by astandard build of thexml.parsers.expat module.

xml.parsers.expat.errors.XML_ERROR_CANT_CHANGE_FEATURE_ONCE_PARSING¶

A behavioral change was requested after parsing started that can only be changedbefore parsing has started. This is (currently) only raised byUseForeignDTD().

xml.parsers.expat.errors.XML_ERROR_UNBOUND_PREFIX¶

An undeclared prefix was found when namespace processing was enabled.

xml.parsers.expat.errors.XML_ERROR_UNDECLARING_PREFIX¶

The document attempted to remove the namespace declaration associated with aprefix.

xml.parsers.expat.errors.XML_ERROR_INCOMPLETE_PE¶

A parameter entity contained incomplete markup.

xml.parsers.expat.errors.XML_ERROR_XML_DECL¶

The document contained no document element at all.

xml.parsers.expat.errors.XML_ERROR_TEXT_DECL¶

There was an error parsing a text declaration in an external entity.

xml.parsers.expat.errors.XML_ERROR_PUBLICID¶

Characters were found in the public id that are not allowed.

xml.parsers.expat.errors.XML_ERROR_SUSPENDED¶

The requested operation was made on a suspended parser, but isn't allowed. Thisincludes attempts to provide additional input or to stop the parser.

xml.parsers.expat.errors.XML_ERROR_NOT_SUSPENDED¶

An attempt to resume the parser was made when the parser had not been suspended.

xml.parsers.expat.errors.XML_ERROR_ABORTED¶

This should not be reported to Python applications.

xml.parsers.expat.errors.XML_ERROR_FINISHED¶

The requested operation was made on a parser which was finished parsing input,but isn't allowed. This includes attempts to provide additional input or tostop the parser.

xml.parsers.expat.errors.XML_ERROR_SUSPEND_PE¶

xml.parsers.expat.errors.XML_ERROR_RESERVED_PREFIX_XML¶

An attempt was made toundeclare reserved namespace prefixxmlor to bind it to another namespace URI.

xml.parsers.expat.errors.XML_ERROR_RESERVED_PREFIX_XMLNS¶

An attempt was made to declare or undeclare reserved namespace prefixxmlns.

xml.parsers.expat.errors.XML_ERROR_RESERVED_NAMESPACE_URI¶

An attempt was made to bind the URI of one the reserved namespaceprefixesxml andxmlns to another namespace prefix.

xml.parsers.expat.errors.XML_ERROR_INVALID_ARGUMENT¶

This should not be reported to Python applications.

xml.parsers.expat.errors.XML_ERROR_NO_BUFFER¶

This should not be reported to Python applications.

xml.parsers.expat.errors.XML_ERROR_AMPLIFICATION_LIMIT_BREACH¶

The limit on input amplification factor (from DTD and entities)has been breached.

xml.parsers.expat.errors.XML_ERROR_NOT_STARTED¶

The parser was tried to be stopped or suspended before it started.

在 3.14 版被加入.

註腳

The encoding string included in XML output should conform to theappropriate standards. For example, "UTF-8" is valid, but "UTF8" isnot. Seehttps://www.w3.org/TR/2006/REC-xml11-20060816/#NT-EncodingDeclandhttps://www.iana.org/assignments/character-sets/character-sets.xhtml.