[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Changes by Serhiy Storchaka : -- resolution: -> not a bug stage: -> resolved status: open -> closed ___ Python tracker ___

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: https://github.com/tiran/defusedxml/pull/4 should fix this, I hope. -- ___ Python tracker ___

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: https://paste.fedoraproject.org/511245/14824393/ is my cut at a fix for this, gonna test it out now. -- ___ Python tracker

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: Digging some more, it looks like *only* Python 3.3 went so far out of its way to hide the pure-Python iterparse() - the code was changed again in 3.4 and it doesn't do that any more. So I think a way forward here is to make the code that uses

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: Aha, so thanks to my colleague Patrick Uiterwijk, we see the problem. Since Python 3.3, Python doesn't actually use that pure-Python iterparse() function if it can instead replace it with a C version:

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: serhiy: so, the funny thing is this: your fix is ultimately a reversion. Though we have to dig way back into the bowels of defusedxml to see this. Specifically, to this commit!

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Adam Williamson added the comment: Ammar: yep, that's correct. There's code in defused's ElementTree.py - _ get_py3_cls() - which passes different values to _generate_etree_functions based on the Python 3 version. For Python 3.2+, defused 0.4.1 expects to use the _IterParseIterator class from

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Serhiy Storchaka added the comment: I think this can be fixed from defusedxml side: def iterparse(source, events=None, parser=None, forbid_dtd=False, forbid_entities=True, forbid_external=True): if not parser: parser =

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Ammar Askar added the comment: >From what I can tell from the failed travis run in defused, the problem is >here: https://github.com/tiran/defusedxml/blob/master/defusedxml/common.py#L129-L141 It's caused by it using the removed _IterParseIterator file (or rather a field that represents it

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Serhiy Storchaka added the comment: Could you please provide an example of code that doesn't work with Python 3.6? -- ___ Python tracker ___

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

Changes by Serhiy Storchaka : -- nosy: +christian.heimes, serhiy.storchaka ___ Python tracker ___

[issue29050] xml.etree.ElementTree in Python 3.6 is incompatible with defusedxml

New submission from Adam Williamson: The changes made to xml.etree.ElementTree in this commit: https://github.com/python/cpython/commit/12a626fae80a57752ccd91ad25b5a283e18154ec break defusedxml , Christian Heimes' library of modified parsers that's intended to be safe for parsing untrusted