Case-insensitive XML declaration detection per XML spec section 2.6 #927

Activity

1. Mingun commented on Dec 26, 2025

   

   Mingun

   on Dec 26, 2025

   Last edited by Mingun

   Collaborator

   More actions

   Yes, I'm aware of this issue. The planned way to fix it it is create a validation layer. Very WIP of how this API may look can be found in my validation branch.

   However, according to the XML spec, only lowercased <?xml must be threated as XML declaration (that still means that <?XML is reserved according to the rules that you correctly highlighted). This is also indirectly implied by the recommended encoding guessing algorithm, which takes into account only lowercased letters.

   Is it important for Flash to have slightly different processing of such syntaxially invalid XMLs (as you noted, you may process <?XML as regular processing instruction, quick-xml never has plans to totally forbid processing of the reserved XML names, it will leave it to the user's wishes).

   ❤️React with ❤️1Reacted by SuchAFuriousDeath
2. Mingun commented on Dec 27, 2025

   

   Mingun

   on Dec 27, 2025

   Collaborator

   More actions

   Actually, you may known distinguish between unclosed Flash XML declaration and processing instructions. .error_position() will point at < of the unclosed <XML, so you may inspect bytes at that location if they looks like Flash declaration.

   .error_position() is a global counter, so you need to save .buffer_position() before reading the event, so you may get the local offset in the buffer to which you read data:

   let r_start = reader.buffer_position();
   let b_start = buf.len();
   match reader.read_event_into(buf) {
     Err(...) => {
       let s = b_start + (reader.error_position() - r_start) as usize;
       if buf[s..s + 5].eq_ignore_ascii_case("<?xml") {
         // Looks like Flash XML declaration
       }
     }
   }

   👀React with 👀1Reacted by SuchAFuriousDeath