refactor(maven-use): use lxml instead of base xml for all parsing
Metadata
Current evaluation
Merged PR #1172 as commit 215eafd4, replacing standard-library XML parsing throughout maven-use with hardened lxml parsing and cleaner XML handling.
Resolution: closed resolved
Reason: The pull request was approved and merged after all listed CI checks passed. Commit 215eafd4 records the completed maven-use lxml refactor.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
-----
Refactors maven-use to use the `lxml` python library, which is safer and allows for (slightly) cleaner XML code. Of note:
- The global parser object is configured with what appear to be the most secure options, informed by [this page](https://lxml.de/FAQ.html#how-do-i-use-lxml-safely-as-a-web-service-endpoint) and [this page](https://lxml.de/parsing.html#parsers). It is then used on every instance of `parse()` and `fromstring()`
- An additional option is used to strip whitespace from XML files, which allows all output XML to be pretty-printed. This aids both tests and future debugging
- XML nodes became doubly-linked-lists, which allows for prepending elements. This is mainly useful for adding comments to an XML file about changes.
- LXML's inner implementation is such that `lxml.etree.Element` is not a type, but rather a function that returns `_Element`. Therefore, it's unfortunately required to typehint with a private element. This seems to be the generally agreed upon approach online, though (Ruff doesn't even mind!).
CRAFT-4593.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #1172 as commit 215eafd4, replacing standard-library XML parsing throughout maven-use with hardened lxml parsing and cleaner XML handling. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged in canonical/craft-parts#1172, replacing base XML parsing in maven-use with lxml for safer parsing and cleaner XML handling. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged a refactor replacing the standard xml library with lxml for safer parsing in maven-use. Approved by three reviewers and passed all CI checks. Updates four files with secure configs and whitespace stripping to improve testability. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Replaced the standard xml library with lxml for maven-use parsing to improve security, enable pretty-printing, simplify node manipulation, and update typehints. Resolves CRAFT-4593. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1138 feat: improve error messages when parsing XML | craft-parts | merged | Merged PR #1138 as commit 281cb7d8, improving maven-use XML parse errors by displaying the full offending XML element for easier debugging. |