Repository navigation
xml.dom.minidom: serializing a comment ending in '-' silently produces non-well-formed XML #156812
Description
Bug report
Bug description:
xml.dom.minidom guards comment serialization against -- (illegal inside an XML comment): Comment.writexml raises ValueError if "--" in self.data (test testSerializeCommentNodeWithDoubleHyphen). It misses a comment whose data ends with -: the trailing - fuses with the closing --> into --->, which contains --.
import xml.dom.minidom as m
doc = m.getDOMImplementation().createDocument(None, None, None)
doc.appendChild(doc.createComment("see note-"))
out = doc.toxml() # '<?xml version="1.0" ?><!--see note--->'
m.parseString(out) # xml.parsers.expat.ExpatError: not well-formedminidom silently emits XML it cannot reparse. The existing -- guard already takes the stance that serialization must fail loudly on comment content it cannot represent; the trailing-- case is a gap in that guard.
CPython versions tested on:
CPython main
Operating systems tested on:
Linux, macOS
Activity
serhiy-storchaka commentedon Nov 11, 2026
Thank you for the report.
Processing instructions have the same gap, and are not checked at all:
'?>'in the data silently closes the instruction, and the reserved targetxmlproduces a document which cannot be parsed.The document type declaration is worse: the identifiers are interpolated into single quotes without any checks, so an identifier containing a quote or a character which is not allowed in it makes the declaration unparseable, and a public identifier without a system identifier is written as
PUBLIC 'p' 'None'.PR #161830 fixes all these cases, including the comment ending with
-, so it supersedes #156813.It only checks the structural rules. The characters in the text, in attribute values and in the content of comments, processing instructions and CDATA sections are still not checked:
\x00,\x0c,\x1fand lone surrogates are written as is. Checking them costs 25–40% of the serialization time for ordinary documents, and up to 10 times more for documents with large text nodes, so it would need an option, like the validate option of the ElementTree serializer in #149469. For now this is documented.