Lather.Xml.Parser (lather v1.1.0)

Copy Markdown View Source

XML parser for processing SOAP responses.

Provides functionality to parse XML documents into Elixir data structures, specifically optimized for SOAP response parsing.

XXE Protection

All parsing goes through SweetXml.parse/2 with dtd: :none, which disables both internal and external DTD/entity processing in the underlying :xmerl_scan. This means:

  • <!DOCTYPE ...> with <!ENTITY ...> declarations are rejected ({:error, {:parse_error, {:fatal, ... :entities_not_allowed ...}}})
  • External DTD fetches (SYSTEM "http://...") are rejected ({:error_fetching_DTD, ... "no external entity allowed"})
  • File-disclosure (file:///etc/passwd), Billion Laughs, and SOAP-envelope-wrapped XXE payloads all return {:error, ...} instead of expanding entities.

All higher-level parsers (Lather.Server.RequestParser, Lather.Wsdl.Analyzer, Lather.Soap.Envelope, Lather.DynamicClient, Lather.Error) delegate to parse/1, so this single choke point protects WSDL, SOAP request, and SOAP response handling.

Summary

Functions

extract_attributes(element)

Extracts all attributes from an XML element.

extract_text(element)

Extracts text content from an XML element.

parse(xml_string)

Parses XML string into an Elixir data structure.

Functions

extract_attributes(element)

@spec extract_attributes(any()) :: map()

Extracts all attributes from an XML element.

extract_text(element)

@spec extract_text(any()) :: String.t() | nil

Extracts text content from an XML element.

parse(xml_string)

@spec parse(String.t()) :: {:ok, map()} | {:error, any()}

Parses XML string into an Elixir data structure.

Parameters

  • xml_string - XML content as a string

Returns

  • {:ok, parsed_data} - Successfully parsed XML as a map
  • {:error, reason} - Parsing error

Examples

iex> xml = "<?xml version=\"1.0\"?><root><item>value</item></root>"
iex> Parser.parse(xml)
{:ok, %{"root" => %{"item" => "value"}}}