Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
encoding/xml: accepts invalid XML with multiple colons #20396
Please answer these questions before submitting your issue. Thanks!
What version of Go are you using (
So looking at this, it seems as though the rune-validation table for NameChar (
Where, as the name indicates, a
Our table was generated from http://www.xml.com/axml/testaxml.htm, which states that a
(under 2.3, Common Syntactic Constructs)
However, there is nothing in this document about qualified names (names with a namespace). Note this quote (below), which states that the use of colons is experimental and not defined by this document.
However, if you look at the w3 docs https://www.w3.org/TR/1998/NOTE-xml-names-0119#dt-qname , qualified names are better defined. This document specifies that there must be at most one colon per name, and that QualifiedName s use a colon as delimiter.
Where a qualified name (in the w3 doc) is composed as:
Another note from w3 docs:
So I would vote that we re-generate the tables based on the w3 docs (or another, more complete set) such that colons are not permitted as
A qualified name (https://www.w3.org/TR/xml-names/#NT-PrefixedName) is treated separately to return prefix and local part. The allowed : is left by char scanning and the occurence of another one was not verified. I submitted a related fix including a specific test.