json2xml 6.4.0__tar.gz → 6.5.1__tar.gz

{json2xml-6.4.0 → json2xml-6.5.1}/HISTORY.rst

@@ -1,4 +1,26 @@
 
+6.5.1 / 2026-08-05
+==================
+
+  * security: pin URL connections to validated DNS addresses to prevent DNS-rebinding bypasses of private-network blocking
+  * security: bound encoded and decoded compressed responses to prevent gzip and deflate resource-exhaustion attacks
+  * fix: reject XML 1.0-forbidden characters consistently across Python and Rust serializers instead of emitting invalid XML
+  * fix: require an actual boolean for ``allow_private_networks`` and normalize malformed-hostname failures as ``URLReadError``
+  * chore: release ``json2xml-rs`` 0.4.3 first and require it from ``json2xml[fast]`` for XML-safe accelerated installs
+  * docs: document URL safety controls, XML validation behavior, migration guidance, and the Rust-first release sequence
+
+
+6.5.0 / 2026-07-15
+==================
+
+  * perf: reduce pure Python serializer time by 31.1% on the deterministic 5,000-record benchmark through exact native-type dispatch
+  * perf: release ``json2xml-rs`` 0.4.2 with hybrid SIMD/word XML escape scanning and a 6.23% benchmark reduction
+  * fix: preserve numeric, string, dictionary, and sequence subclass behavior across the optimized Python dispatch paths
+  * test: require exactly 100% statement coverage from the complete Python suite and add dense Rust XML escape scanning regression coverage
+  * chore: require ``json2xml-rs>=0.4.2`` from ``json2xml[fast]`` and validate release wheels before PyPI publication
+  * docs: add Python and Rust before/after flamegraphs, buffer-capacity measurements, and release performance notes
+
+
 6.4.0 / 2026-07-13
 ==================
 

{json2xml-6.4.0 → json2xml-6.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: json2xml
-Version: 6.4.0
+Version: 6.5.1
 Summary: Simple Python Library to convert JSON to XML
 Author-email: Vinit Kumar <mail@vinitkumar.me>
 License: Apache Software License 2.0
@@ -32,7 +32,7 @@ Requires-Dist: setuptools; extra == "dev"
 Requires-Dist: pygments>=2.20.0; extra == "dev"
 Requires-Dist: xmltodict>=0.12.0; extra == "dev"
 Provides-Extra: fast
-Requires-Dist: json2xml-rs>=0.4.1; extra == "fast"
+Requires-Dist: json2xml-rs>=0.4.3; extra == "fast"
 Dynamic: license-file
 
 .. image:: ./json2xml-hero.png
@@ -276,6 +276,21 @@ You can use the json2xml library in the following ways:
     data = readfromjson("examples/licht.json")
     print(json2xml.Json2xml(data).to_xml())
 
+URL reads accept only credential-free HTTP(S), reject redirects and non-public
+destinations by default, pin public connections to their validated DNS address,
+and stop after 10 MiB of encoded or decoded content. Gzip and deflate responses
+honor ``Content-Length`` and are decoded incrementally; other content encodings
+are rejected. Trusted library callers can opt into a private endpoint with the
+boolean ``True`` or choose a smaller limit:
+
+.. code-block:: python
+
+    data = readfromurl(
+        "http://127.0.0.1:8000/data.json",
+        allow_private_networks=True,
+        max_response_bytes=1024 * 1024,
+    )
+
 
 Custom Wrappers and Indentation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

{json2xml-6.4.0 → json2xml-6.5.1}/README.rst

@@ -239,6 +239,21 @@ You can use the json2xml library in the following ways:
     data = readfromjson("examples/licht.json")
     print(json2xml.Json2xml(data).to_xml())
 
+URL reads accept only credential-free HTTP(S), reject redirects and non-public
+destinations by default, pin public connections to their validated DNS address,
+and stop after 10 MiB of encoded or decoded content. Gzip and deflate responses
+honor ``Content-Length`` and are decoded incrementally; other content encodings
+are rejected. Trusted library callers can opt into a private endpoint with the
+boolean ``True`` or choose a smaller limit:
+
+.. code-block:: python
+
+    data = readfromurl(
+        "http://127.0.0.1:8000/data.json",
+        allow_private_networks=True,
+        max_response_bytes=1024 * 1024,
+    )
+
 
 Custom Wrappers and Indentation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

{json2xml-6.4.0 → json2xml-6.5.1}/docs/usage.rst

@@ -32,6 +32,19 @@ Here's how to use each method:
     data = readfromjson("examples/licht.json")
     print(json2xml.Json2xml(data).to_xml())
 
+URL reads accept only credential-free HTTP(S), reject redirects and non-public
+destinations by default, and stop after 10 MiB of decoded content. Trusted
+library callers can explicitly allow a private endpoint while retaining a
+chosen response limit:
+
+.. code-block:: python
+
+    data = readfromurl(
+        "http://127.0.0.1:8000/data.json",
+        allow_private_networks=True,
+        max_response_bytes=1024 * 1024,
+    )
+
 
 Real-world Examples
 -------------------

{json2xml-6.4.0 → json2xml-6.5.1}/json2xml/__init__.py

@@ -2,4 +2,4 @@
 
 __author__ = """Vinit Kumar"""
 __email__ = "mail@vinitkumar.me"
-__version__ = "6.4.0"
+__version__ = "6.5.1"

{json2xml-6.4.0 → json2xml-6.5.1}/json2xml/dicttoxml.py

@@ -79,6 +79,16 @@ ELEMENT = Union[
 ]
 
 
+def _is_number(value: Any) -> bool:
+    """Recognize common numbers without paying for abstract-class dispatch."""
+    value_type = type(value)
+    if value_type is bool:
+        return False
+    if value_type is int or value_type is float or value_type is complex:
+        return True
+    return isinstance(value, numbers.Number)
+
+
 def get_xml_type(val: Any) -> str:
     """
     Get the XML type of a given value.
@@ -100,7 +110,13 @@ def get_xml_type(val: Any) -> str:
         return "float"
     if val_type is bool:
         return "bool"
-    if isinstance(val, numbers.Number):
+    if val_type is dict:
+        return "dict"
+    if val_type is list or val_type is tuple:
+        return "list"
+    if isinstance(val, str):
+        return "str"
+    if _is_number(val):
         return "number"
     if isinstance(val, dict):
         return "dict"
@@ -109,6 +125,28 @@ def get_xml_type(val: Any) -> str:
     return type(val).__name__
 
 
+# @lat: [[behavior#XML output safety]]
+def _validate_xml_chars(value: str) -> None:
+    """Reject characters excluded from the XML 1.0 Char production."""
+    # XML 1.0 character production: https://www.w3.org/TR/xml/#charsets
+    # isprintable() keeps the common path in C; only strings containing a
+    # non-printable character need the explicit code-point boundary checks.
+    if not value or value.isprintable():
+        return
+
+    for character in value:
+        codepoint = ord(character)
+        is_forbidden_control = (
+            codepoint < 0x20 and codepoint not in (0x09, 0x0A, 0x0D)
+        )
+        is_surrogate = 0xD800 <= codepoint <= 0xDFFF
+        is_bmp_noncharacter = codepoint in (0xFFFE, 0xFFFF)
+        if is_forbidden_control or is_surrogate or is_bmp_noncharacter:
+            raise ValueError(
+                f"Character U+{codepoint:04X} is not allowed in XML 1.0"
+            )
+
+
 def escape_xml(s: str | int | float | numbers.Number | None) -> str:
     """
     Escape a string for use in XML.
@@ -119,15 +157,15 @@ def escape_xml(s: str | int | float | numbers.Number | None) -> str:
     Returns:
         str: The escaped string.
     """
-    if isinstance(s, str):
-        if not _XML_ESCAPE_CHARS.intersection(s):
-            return s
-        s = s.replace("&", "&amp;")
-        s = s.replace('"', "&quot;")
-        s = s.replace("'", "&apos;")
-        s = s.replace("<", "&lt;")
-        s = s.replace(">", "&gt;")
-    return str(s)
+    value = s if isinstance(s, str) else str(s)
+    _validate_xml_chars(value)
+    if _XML_ESCAPE_CHARS.isdisjoint(value):
+        return value
+    value = value.replace("&", "&amp;")
+    value = value.replace('"', "&quot;")
+    value = value.replace("'", "&apos;")
+    value = value.replace("<", "&lt;")
+    return value.replace(">", "&gt;")
 
 
 def make_attrstring(attr: dict[str, Any]) -> str:
@@ -142,12 +180,13 @@ def make_attrstring(attr: dict[str, Any]) -> str:
     """
     if not attr:
         return ""
-    validate_xml_attr_names(attr)
     if len(attr) == 1:
         key, val = next(iter(attr.items()))
         if key == "type":
-            return f' type="{val}"'
+            return f' type="{escape_xml(val)}"'
+        validate_xml_attr_names(attr)
         return f' {key}="{escape_xml(val)}"'
+    validate_xml_attr_names(attr)
     attrstring = " ".join(f'{k}="{escape_xml(v)}"' for k, v in attr.items())
     return f" {attrstring}"
 
@@ -246,8 +285,10 @@ def make_valid_xml_name(key: str, attr: dict[str, Any]) -> tuple[str, dict[str,
 
 def wrap_cdata(s: str | int | float | numbers.Number) -> str:
     """Wraps a string into CDATA sections"""
-    s = str(s).replace("]]>", "]]]]><![CDATA[>")
-    return "<![CDATA[" + s + "]]>"
+    value = str(s)
+    _validate_xml_chars(value)
+    value = value.replace("]]>", "]]]]><![CDATA[>")
+    return "<![CDATA[" + value + "]]>"
 
 
 def default_item_func(parent: str) -> str:
@@ -277,7 +318,7 @@ def get_xpath31_tag_name(val: Any) -> str:
         return "boolean"
     if isinstance(val, dict):
         return "map"
-    if isinstance(val, (int, float, numbers.Number)):
+    if _is_number(val):
         return "number"
     if isinstance(val, str):
         return "string"
@@ -368,7 +409,7 @@ def convert(
 
 
 def is_primitive_type(val: Any) -> bool:
-    return val is None or isinstance(val, (str, bool, numbers.Number))
+    return val is None or isinstance(val, (str, bool)) or _is_number(val)
 
 
 def dict2xml_str(
@@ -493,12 +534,45 @@ def _append_convert(
 ) -> None:
     """Append converted XML directly into output without building subtree strings."""
     item_name = item_func(parent)
+    obj_type = type(obj)
 
-    if isinstance(obj, bool):
+    # Exact built-ins stay ahead of ABC/subclass checks on this hot path. The
+    # later isinstance/_is_number branches intentionally preserve compatible
+    # str, numeric, dict, and sequence subclasses without charging native JSON
+    # values for abstract dispatch.
+    if obj_type is bool:
         output.write(convert_bool(key=item_name, val=obj, attr_type=attr_type, cdata=cdata))
-    elif isinstance(obj, numbers.Number):
+    elif obj_type is str:
         output.write(convert_kv(key=item_name, val=obj, attr_type=attr_type, attr={}, cdata=cdata))
-    elif isinstance(obj, str):
+    elif obj_type is int or obj_type is float or obj_type is complex:
+        output.write(convert_kv(key=item_name, val=obj, attr_type=attr_type, attr={}, cdata=cdata))
+    elif obj is None:
+        output.write(convert_none(key=item_name, attr_type=attr_type, cdata=cdata))
+    elif obj_type is dict:
+        _append_convert_dict(
+            output,
+            cast("dict[str, Any]", obj),
+            ids,
+            parent,
+            attr_type,
+            item_func,
+            cdata,
+            item_wrap,
+            list_headers=list_headers,
+        )
+    elif obj_type is list or obj_type is tuple:
+        _append_convert_list(
+            output,
+            obj,
+            ids,
+            parent,
+            attr_type,
+            item_func,
+            cdata,
+            item_wrap,
+            list_headers=list_headers,
+        )
+    elif isinstance(obj, str) or _is_number(obj):
         output.write(convert_kv(key=item_name, val=obj, attr_type=attr_type, attr={}, cdata=cdata))
     elif hasattr(obj, "isoformat") and isinstance(obj, (datetime.datetime, datetime.date)):
         output.write(
@@ -510,8 +584,6 @@ def _append_convert(
                 cdata=cdata,
             )
         )
-    elif obj is None:
-        output.write(convert_none(key=item_name, attr_type=attr_type, cdata=cdata))
     elif isinstance(obj, dict):
         _append_convert_dict(
             output,
@@ -628,9 +700,24 @@ def _append_rawitem(
 ) -> None:
     if rawitem is None:
         return
-    if isinstance(rawitem, bool):
+    rawitem_type = type(rawitem)
+    if rawitem_type is bool:
         output.write("true" if rawitem else "false")
-    elif isinstance(rawitem, (str, numbers.Number)):
+    elif rawitem_type is str or rawitem_type is int or rawitem_type is float or rawitem_type is complex:
+        output.write(escape_xml(str(rawitem)))
+    elif rawitem_type is dict or rawitem_type is list or rawitem_type is tuple:
+        _append_convert(
+            output,
+            rawitem,
+            ids,
+            attr_type,
+            item_func,
+            cdata,
+            item_wrap,
+            item_name,
+            list_headers=list_headers,
+        )
+    elif isinstance(rawitem, str) or _is_number(rawitem):
         output.write(escape_xml(str(rawitem)))
     else:
         _append_convert(
@@ -708,15 +795,47 @@ def _append_convert_dict(
 ) -> None:
     """Append a dict as XML without allocating a joined child subtree."""
     for key, val in obj.items():
+        val_type = type(val)
         attr = {} if not ids else {"id": f"{get_unique_id(parent)}"}
         key_is_flat = isinstance(key, str) and key.endswith("@flat")
         xml_key = key[:-5] if key_is_flat else key
 
         key, attr = make_valid_xml_name(xml_key, attr)
 
-        if isinstance(val, bool):
+        if val_type is bool:
             output.write(convert_bool_valid_name(key, val, attr_type, attr))
-        elif isinstance(val, (numbers.Number, str)):
+        elif val_type is str or val_type is int or val_type is float or val_type is complex:
+            output.write(
+                convert_kv_valid_name(
+                    key=key, val=val, attr_type=attr_type, attr=attr, cdata=cdata
+                )
+            )
+        elif val_type is dict:
+            _append_dict2xml_str(
+                output,
+                attr_type,
+                attr,
+                val,
+                item_func,
+                cdata,
+                key,
+                item_wrap,
+                False,
+                list_headers=list_headers,
+            )
+        elif val_type is list or val_type is tuple:
+            _append_list2xml_str(
+                output,
+                attr_type=attr_type,
+                attr=attr,
+                item=val,
+                item_func=item_func,
+                cdata=cdata,
+                item_name=f"{key}@flat" if key_is_flat else key,
+                item_wrap=item_wrap,
+                list_headers=list_headers,
+            )
+        elif isinstance(val, str) or _is_number(val):
             output.write(
                 convert_kv_valid_name(
                     key=key, val=val, attr_type=attr_type, attr=attr, cdata=cdata
@@ -784,16 +903,58 @@ def _append_convert_list(
     this_id = get_unique_id(parent) if ids else None
 
     for i, item in enumerate(items):
+        item_type = type(item)
         base_attr: dict[str, Any] | None = None
         if ids:
             base_attr = {"id": f"{this_id}_{i + 1}"}
 
-        if isinstance(item, bool):
+        if item_type is bool:
             attr = dict(base_attr) if base_attr else {}
             if item_name_attr:
                 attr.update(item_name_attr)
             output.write(convert_bool_valid_name(item_name, item, attr_type, attr))
-        elif isinstance(item, (numbers.Number, str)):
+        elif item_type is str or item_type is int or item_type is float or item_type is complex:
+            attr = dict(base_attr) if base_attr else {}
+            if scalar_key_attr:
+                attr.update(scalar_key_attr)
+            output.write(
+                convert_kv_valid_name(
+                    key=scalar_key,
+                    val=item,
+                    attr_type=attr_type,
+                    attr=attr,
+                    cdata=cdata,
+                )
+            )
+        elif item_type is dict:
+            attr = dict(base_attr) if base_attr else {}
+            _append_dict2xml_str(
+                output,
+                attr_type=attr_type,
+                attr=attr,
+                item=item,
+                item_func=item_func,
+                cdata=cdata,
+                item_name=item_name,
+                item_wrap=item_wrap,
+                parentIsList=True,
+                parent=parent,
+                list_headers=list_headers,
+            )
+        elif item_type is list or item_type is tuple:
+            attr = dict(base_attr) if base_attr else {}
+            _append_list2xml_str(
+                output,
+                attr_type=attr_type,
+                attr=attr,
+                item=item,
+                item_func=item_func,
+                cdata=cdata,
+                item_name=item_name,
+                item_wrap=item_wrap,
+                list_headers=list_headers,
+            )
+        elif isinstance(item, str) or _is_number(item):
             attr = dict(base_attr) if base_attr else {}
             if scalar_key_attr:
                 attr.update(scalar_key_attr)
@@ -976,6 +1137,7 @@ class _XPathDocumentRenderer:
         return output.to_bytes()
 
 
+# @lat: [[behavior#XML output safety]]
 class _NamespaceFormatter:
     """Keep namespace emission and schema-attribute quirks in one place."""
 
@@ -985,21 +1147,38 @@ class _NamespaceFormatter:
             return ""
 
         namespace_parts: list[str] = []
-        for prefix in xml_namespaces:
+        for prefix, namespace_value in xml_namespaces.items():
             if prefix == "xsi":
-                for schema_att in xml_namespaces[prefix]:
+                if not isinstance(namespace_value, dict):
+                    raise ValueError("The xsi namespace value must be a mapping")
+                if (
+                    "schemaLocation" in namespace_value
+                    and "schemaInstance" not in namespace_value
+                ):
+                    raise ValueError(
+                        "xsi schemaLocation requires a schemaInstance namespace"
+                    )
+                for schema_att in namespace_value:
                     if schema_att == "schemaInstance":
                         namespace_parts.append(
-                            f' xmlns:{prefix}="{xml_namespaces[prefix]["schemaInstance"]}"'
+                            f' xmlns:{prefix}="{escape_xml(namespace_value[schema_att])}"'
                         )
                     elif schema_att == "schemaLocation":
                         namespace_parts.append(
-                            f' xsi:{schema_att}="{xml_namespaces[prefix][schema_att]}"'
+                            f' xsi:{schema_att}="{escape_xml(namespace_value[schema_att])}"'
                         )
             elif prefix == "xmlns":
-                namespace_parts.append(f' xmlns="{xml_namespaces[prefix]}"')
+                namespace_parts.append(f' xmlns="{escape_xml(namespace_value)}"')
             else:
-                namespace_parts.append(f' xmlns:{prefix}="{xml_namespaces[prefix]}"')
+                if (
+                    not isinstance(prefix, str)
+                    or prefix.lower().startswith("xml")
+                    or not key_is_valid_xml(prefix)
+                ):
+                    raise ValueError(f"Invalid XML namespace prefix: {prefix}")
+                namespace_parts.append(
+                    f' xmlns:{prefix}="{escape_xml(namespace_value)}"'
+                )
         return "".join(namespace_parts)
 
 

{json2xml-6.4.0 → json2xml-6.5.1}/json2xml/dicttoxml_fast.py

@@ -30,12 +30,29 @@ _rust_dicttoxml: Callable[..., bytes] | None = None
 rust_escape_xml: RustStringTransform | None = None
 rust_wrap_cdata: RustStringTransform | None = None
 
+
+def _rejects_invalid_xml(escape: RustStringTransform) -> bool:
+    """Return whether an optional backend enforces XML 1.0 characters."""
+    try:
+        escape("\x00")
+    except ValueError:
+        return True
+    except Exception:
+        return False
+    return False
+
+
 try:
     from json2xml_rs import dicttoxml as _rust_dicttoxml  # pragma: no cover
     from json2xml_rs import escape_xml_py as rust_escape_xml  # pragma: no cover
     from json2xml_rs import wrap_cdata_py as rust_wrap_cdata  # pragma: no cover
-    _use_rust = True  # pragma: no cover
-    LOG.debug("Using Rust backend for dicttoxml")  # pragma: no cover
+    if _rejects_invalid_xml(rust_escape_xml):  # pragma: no cover
+        _use_rust = True  # pragma: no cover
+        LOG.debug("Using Rust backend for dicttoxml")  # pragma: no cover
+    else:  # pragma: no cover
+        LOG.warning(  # pragma: no cover
+            "Ignoring an outdated Rust backend that permits invalid XML characters"
+        )
 except ImportError:  # pragma: no cover
     LOG.debug("Rust backend not available, using pure Python")
 

json2xml-6.5.1/json2xml/json2xml.py

@@ -0,0 +1,83 @@
+from typing import Any
+
+__lazy_modules__ = ["defusedxml.minidom", "pyexpat"]
+
+from . import dicttoxml_fast as dicttoxml
+from .types import JSONValue
+from .utils import InvalidDataError
+
+
+# @lat: [[architecture#Core pipeline]]
+class Json2xml:
+    """Configure conversion of a decoded JSON value to XML.
+
+    :param data: The decoded JSON value. ``None`` represents absent input; other falsy values
+        are serialized.
+    :param wrapper: The root element name used when ``root`` is enabled.
+    :param root: Include the XML declaration and root element.
+    :param pretty: Reparse and indent the serialized XML, returning text instead of bytes.
+    :param attr_type: Add each value's JSON type as an XML attribute.
+    :param item_wrap: Wrap list members in ``<item>`` elements.
+    :param xpath_format: Emit the W3C XPath 3.1 JSON-to-XML representation.
+    :param cdata: Wrap string values in CDATA sections.
+    :param list_headers: Repeat the parent element for nested dictionary items in lists.
+    """
+    def __init__(
+        self,
+        data: JSONValue = None,
+        wrapper: str = "all",
+        root: bool = True,
+        pretty: bool = True,
+        attr_type: bool = True,
+        item_wrap: bool = True,
+        xpath_format: bool = False,
+        cdata: bool = False,
+        list_headers: bool = False,
+    ):
+        self.data = data
+        self.pretty = pretty
+        self.wrapper = wrapper
+        self.attr_type = attr_type
+        self.root = root
+        self.item_wrap = item_wrap
+        self.xpath_format = xpath_format
+        self.cdata = cdata
+        self.list_headers = list_headers
+
+    # @lat: [[behavior#Conversion output]]
+    # @lat: [[behavior#Invalid XML payloads]]
+    def to_xml(self) -> bytes | str | None:
+        """Serialize the configured JSON value.
+
+        :return: Pretty-printed XML text when ``pretty`` is enabled, UTF-8 encoded XML bytes
+            otherwise, or ``None`` when the configured data is ``None``.
+        :raises InvalidDataError: If serialization rejects the data or pretty-print parsing finds
+            malformed XML.
+        """
+        if self.data is not None:
+            try:
+                xml_data = dicttoxml.dicttoxml(
+                    self.data,
+                    root=self.root,
+                    custom_root=self.wrapper,
+                    attr_type=self.attr_type,
+                    item_wrap=self.item_wrap,
+                    xpath_format=self.xpath_format,
+                    cdata=self.cdata,
+                    list_headers=self.list_headers,
+                )
+            except ValueError as error:
+                raise InvalidDataError from error
+            if self.pretty:
+                # Keep parser imports off the compact-output path, which returns serializer bytes directly.
+                from pyexpat import ExpatError
+
+                from defusedxml.minidom import parseString
+
+                try:
+                    result = parseString(xml_data).toprettyxml(encoding="UTF-8").decode()
+                except ExpatError:
+                    raise InvalidDataError
+                return result
+            return xml_data
+        return None