larzxml

Ergonomic XML builder + an XXE-safe parser — zero dependencies.

The standard library makes two XML tasks harder than they should be: building XML reads clumsily with ElementTree, and parsing untrusted XML is dangerous by default (XXE and billion-laughs attacks). larzxml fixes both — a fluent builder that escapes correctly, and a parser that refuses DTDs and entities, so external-entity and exponential-expansion attacks simply can't happen.

Install

pip install larzxml

Use

from larzxml import element, parse

root = element("order", id="42")
root.sub("item", text="Widget", sku="A1")
root.sub("item", text="Gadget & <friends>", sku="B2")   # escaped safely
print(root.to_xml(pretty=True))

tree = parse(xml_text)              # safe by default
tree.find("item").text
tree.findall("item")

Safe by construction

parse('<!DOCTYPE x [<!ENTITY e SYSTEM "file:///etc/passwd">]><x>&e;</x>')
# -> XMLError: DTD/DOCTYPE is not allowed (XXE-safe parser)

DTDs and entity declarations are rejected, so both XXE (reading local files / SSRF) and billion-laughs (exponential entity expansion) are impossible — you don't have to remember to harden anything.

Tests

python -m unittest discover -s tests -v   # 14 tests (incl. XXE + billion-laughs)

The Larz stack

One of 60+ pure-Python, zero-dependency libraries at github.com/larz-scripter. The XML sibling of larzhtml (XSS-safe HTML) and larzjson.

License

MIT (c) larz-scripter