Metadata-Version: 2.4
Name: larzxml
Version: 0.1.0
Summary: Ergonomic XML builder and XXE-safe parser - zero dependencies
Author: larz-scripter
License: MIT
Project-URL: Homepage, https://github.com/larz-scripter/larzxml
Project-URL: Repository, https://github.com/larz-scripter/larzxml
Project-URL: Issues, https://github.com/larz-scripter/larzxml/issues
Keywords: xml,parser,builder,xxe,security,elementtree,zero-dependency,pure-python
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# larzxml

**Ergonomic XML builder + an XXE-safe parser — zero dependencies.**

The standard library makes two XML tasks harder than they should be: *building*
XML reads clumsily with ElementTree, and *parsing untrusted* XML is dangerous by
default (XXE and billion-laughs attacks). larzxml fixes both — a fluent builder
that escapes correctly, and a parser that **refuses DTDs and entities**, so
external-entity and exponential-expansion attacks simply can't happen.

## Install

```bash
pip install larzxml
```

## Use

```python
from larzxml import element, parse

root = element("order", id="42")
root.sub("item", text="Widget", sku="A1")
root.sub("item", text="Gadget & <friends>", sku="B2")   # escaped safely
print(root.to_xml(pretty=True))

tree = parse(xml_text)              # safe by default
tree.find("item").text
tree.findall("item")
```

### Safe by construction

```python
parse('<!DOCTYPE x [<!ENTITY e SYSTEM "file:///etc/passwd">]><x>&e;</x>')
# -> XMLError: DTD/DOCTYPE is not allowed (XXE-safe parser)
```

DTDs and entity declarations are rejected, so both **XXE** (reading local files /
SSRF) and **billion-laughs** (exponential entity expansion) are impossible —
you don't have to remember to harden anything.

## Tests

```bash
python -m unittest discover -s tests -v   # 14 tests (incl. XXE + billion-laughs)
```

## The Larz stack

One of 60+ pure-Python, zero-dependency libraries at
[github.com/larz-scripter](https://github.com/larz-scripter). The XML sibling of
[larzhtml](https://github.com/larz-scripter/larzhtml) (XSS-safe HTML) and
[larzjson](https://github.com/larz-scripter/larzjson).

## License

MIT (c) larz-scripter
