Hi @martinblech,

it was brought to my attention that xmltodict and Expat >=2.4.5 are not compatible. The incompatibility has two halves:

• xmltodict is using : (colon) for a namespace separator at multiple places, for instance:

  # git --no-pager grep "namespace_separator='"
  xmltodict.py:                 namespace_separator=':',
  xmltodict.py:          namespace_separator=':', disable_entities=True, process_comments=False, **kwargs):
  xmltodict.py:          namespace_separator=':',

• Expat disallows use of namespace separator characters in xmlns attribute values for security since 2.4.5 and PR [CVE-2022-25236] lib: Protect against insertion of namesep characters into namespace URIs libexpat/libexpat#561.

The API docs of XML_ParserCreateNS say:

This means that you should pick a character for sep that can't be part of an URI.

Colon can appear in a URI (RFC 3986), so a colon cannot be used as a namespace separator or there will be false positives. Use of " " (space) or "\n" (line feed) would work.

Would you be up for picking a different character for a namespace separator?

Thanks and best, Sebastian

CC libwbxml/libwbxml#76
CC libexpat/libexpat#572 (comment)