XML tree has a cyclic tag processing bug

[personnumber3377]

Bug report

Bug description:

Hi!

I am trying to write a mutator for svg files and when mutating an svg file I am encountering this bug here:

elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>
elem: <Element '{http://www.w3.org/2000/svg}g' at 0x7fb7994868e0>
elem: <Element '{http://www.w3.org/2000/svg}defs' at 0x7fb799487e20>

In this loop here:

    # populate qname and namespaces table
    for elem in elem.iter():
        print("elem: "+str(elem))
        tag = elem.tag
        if isinstance(tag, QName):
            if tag.text not in qnames:
                add_qname(tag.text)
        elif isinstance(tag, str):
            if tag not in qnames:
                add_qname(tag)
        elif tag is not None and tag is not Comment and tag is not PI:
            _raise_serialization_error(tag)
        for key, value in elem.items():
            if isinstance(key, QName):
                key = key.text
            if key not in qnames:
                add_qname(key)
            if isinstance(value, QName) and value.text not in qnames:
                add_qname(value.text)
        text = elem.text
        if isinstance(text, QName) and text.text not in qnames:
            add_qname(text.text)
    return qnames, namespaces

the bug can be reproduced with:

import xml.etree.ElementTree as ET
root = ET.Element("g")
defs = ET.SubElement(root, "defs")
defs.append(root)
list(root.iter())

I assume that an infinite loop when serializing the tree back to a string is unintended.

I tested this on an older python version, but it seems that the code is quite unchanged in the newer versions too.

CPython versions tested on:

3.10, 3.12

Operating systems tested on:

Linux

[StanFromIreland]

I edited your post with a minimal reproducer that doesn’t require running your big script.

[serhiy-storchaka]

This only works for a tree. Your structure is not a tree. Garbage in -- garbage out.