4 ms·

> pulling in a third party library wasn't a viable option How? I would violently object for implementing an in-house XML parser as opposed to just finding a wa

> pulling in a third party library wasn't a viable option How? I would violently object for implementing an in-house XML parser as opposed to just finding a way to include libxml2. It's under the MIT license, so I doubt that was an issue.

plugin-baby 4y ago
Do you have other objections beyond the wasted effort of re-writing the wheel?
- planede 4y ago
  I think a lot of people trivialize XML parsing here. Given how many dedicated libraries screwed up JSON parsing, which should be much easier, I have very little faith in people getting XML parsing right in-house.
  - TedDoesntTalk 4y ago
    There are many security vulnerability vectors in xml parsing. A lot (but not all) have to do with DTD entity replacement, calls to remote URLs for schemas, and the like, buffer overflows (values too large).
maskros 4y ago
libxml2 can be massive overkill if you just want to parse XML data. Unless you need schema validation and namespaces and all that jazz, you can parse XML in C with a simple state machine of ~200 lines. Add another 200 to build a DOM-like structure. https://github.com/ccxvii/snippets/blob/master/xml.c#L326 https://github.com/ccxvii/snippets/blob/master/xml.c#L326 Or in lua with ~200 lines altogether: https://github.com/ccxvii/snippets/blob/master/xml.lua https://github.com/ccxvii/snippets/blob/master/xml.lua
johannes1234321 4y ago
Yes, libxml2 is a widespread, thus mostly unproblematic choice. However pulling in a third party is not only about license. With a thirdparty library you have to follow security updates (also to parts you don't need), may have build issues on some platforms you want to support (something embedded?) and so on. If you don't need XML, but just a few xml-like tags a custom parser can be done quickly. But yes then you get to the NHI problems and what if your assumptions about XML subset were wrong ... Personally I would lean on an XML lib (maybe libyml2, maybe qxml, maybe windows API, ... depending on context) as XML is complex, but generally adding libraries introduce their costs.
sgtnoodle 4y ago
I didn't need to parse any XML file, but rather a specific XML file. It was inside an ITAR restricted codebase, and lawyers are conservative about open source in that context. In terms of security, it wasn't internet facing, and was written to the same standard as safety critical embedded software.

plugin-baby 4y ago

Do you have other objections beyond the wasted effort of re-writing the wheel?

planede 4y ago
I think a lot of people trivialize XML parsing here. Given how many dedicated libraries screwed up JSON parsing, which should be much easier, I have very little faith in people getting XML parsing right in-house.
- TedDoesntTalk 4y ago
  There are many security vulnerability vectors in xml parsing. A lot (but not all) have to do with DTD entity replacement, calls to remote URLs for schemas, and the like, buffer overflows (values too large).

maskros 4y ago

libxml2 can be massive overkill if you just want to parse XML data. Unless you need schema validation and namespaces and all that jazz, you can parse XML in C with a simple state machine of ~200 lines. Add another 200 to build a DOM-like structure. https://github.com/ccxvii/snippets/blob/master/xml.c#L326 https://github.com/ccxvii/snippets/blob/master/xml.c#L326 Or in lua with ~200 lines altogether: https://github.com/ccxvii/snippets/blob/master/xml.lua https://github.com/ccxvii/snippets/blob/master/xml.lua

johannes1234321 4y ago

Yes, libxml2 is a widespread, thus mostly unproblematic choice. However pulling in a third party is not only about license. With a thirdparty library you have to follow security updates (also to parts you don't need), may have build issues on some platforms you want to support (something embedded?) and so on. If you don't need XML, but just a few xml-like tags a custom parser can be done quickly. But yes then you get to the NHI problems and what if your assumptions about XML subset were wrong ... Personally I would lean on an XML lib (maybe libyml2, maybe qxml, maybe windows API, ... depending on context) as XML is complex, but generally adding libraries introduce their costs.

sgtnoodle 4y ago

I didn't need to parse any XML file, but rather a specific XML file. It was inside an ITAR restricted codebase, and lawyers are conservative about open source in that context. In terms of security, it wasn't internet facing, and was written to the same standard as safety critical embedded software.