refactor(maven-use): use lxml instead of base xml for all parsing
Metadata
Current evaluation
Merged a refactor replacing the standard xml library with lxml for safer parsing in maven-use. Approved by three reviewers and passed all CI checks. Updates four files with secure configs and whitespace stripping to improve testability.
Suggested action: —
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
-----
Refactors maven-use to use the `lxml` python library, which is safer and allows for (slightly) cleaner XML code. Of note:
- The global parser object is configured with what appear to be the most secure options, informed by [this page](https://lxml.de/FAQ.html#how-do-i-use-lxml-safely-as-a-web-service-endpoint) and [this page](https://lxml.de/parsing.html#parsers). It is then used on every instance of `parse()` and `fromstring()`
- An additional option is used to strip whitespace from XML files, which allows all output XML to be pretty-printed. This aids both tests and future debugging
- XML nodes became doubly-linked-lists, which allows for prepending elements. This is mainly useful for adding comments to an XML file about changes.
- LXML's inner implementation is such that `lxml.etree.Element` is not a type, but rather a function that returns `_Element`. Therefore, it's unfortunately required to typehint with a private element. This seems to be the generally agreed upon approach online, though (Ruff doesn't even mind!).
CRAFT-4593.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged a refactor replacing the standard xml library with lxml for safer parsing in maven-use. Approved by three reviewers and passed all CI checks. Updates four files with secure configs and whitespace stripping to improve testability. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Replaced the standard xml library with lxml for maven-use parsing to improve security, enable pretty-printing, simplify node manipulation, and update typehints. Resolves CRAFT-4593. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1138 feat: improve error messages when parsing XML | craft-parts | merged | Merged enhancement improving XML parsing error messages in the maven-use plugin. Replaces unhelpful empty errors with full XML element output for debugging. Approved by two reviewers, passed all CI checks, and modified 5 files (+47/-14). |