XMLGuide
Handy Command Line Tools for XML Work in Daily Practice
The command-line tools that cover daily XML work: xmllint, xmlstarlet, xsltproc, xq and yq, with tested commands, timings, exit codes and the traps of each.
19 min read
Library
Everything you need to level up your coding skills.
YAMLGuide
Converting YAML to and From JSON CSV XML and Excel
What survives when YAML becomes JSON, CSV, XML or Excel and back, with a tested loss matrix, the type traps in each direction and a conversion checklist.
19 min read
XML
Sanitizing Data You Put Into an XML Document Safely
User text put into XML by string formatting can add elements and attributes. See the injection, the escaping that stops it, CDATA, bad characters and names.
7 min read
XML
Limiting XML Size and Depth for Uploads With Measured Limits
Where lxml and ElementTree stop on deep nesting, long text nodes and wide documents, what a tree costs in memory, and the limits to set for uploads.
7 min read
XML
XML Signature Wrapping in Plain Language With a Toy Example
Signature wrapping moves a signed element so the signature verifies while the app reads another. A toy HMAC example shows the gap and the fix.
6 min read
XML
Safe XML Handling in PHP and Node for Untrusted Input
Parse untrusted XML in PHP 8.5 and Node 24: why LIBXML_NOENT is the dangerous flag, what DOMDocument does, and how two Node parsers behave.
6 min read
XML
Disabling DTDs and External Entities in Java and Python
Parser settings that stop XXE in Java and Python, tested on one file: which Java features block it, what each error says, and the lxml options.
7 min read
XML
Stopping the Billion Laughs Attack in Your XML Parser
A 547-byte file that expands to 30 million characters. How lxml, ElementTree and Java refused it, what the limits are, and the settings that keep them on.
6 min read
XML
What an XML External Entity Attack Is and Where It Works
An XXE attack makes a parser read a file or fetch a URL the sender names. Run on five parsers, three leaked a local file by default or with one flag.
7 min read
XMLGuide
XML Security Problems to Close Before Production Launch
The XML attacks that matter for web services and loaders, how six parsers behave, one parse function with limits, and the tests that keep it closed.
18 min read
XML
Reading Office Open XML From Docx and Xlsx Files in Python
A docx or xlsx is a zip of XML files. Open it with zipfile, read the paragraphs, runs and tables of a docx and the shared strings and cells of an xlsx.
7 min read
XMLGuide
Common XML Formats You Will Meet in Real Work Reference
A reference to the XML formats you meet in practice: how to recognize each by root and namespace, what to extract, and the trap each one carries.
19 min read
Get new articles by email
We send one email when a new article is published. No spam.