xml: create new XML parser #300

New Issue

Open

opened 2022-06-24 11:45:33 +00:00 by SamWhited · 0 comments

SamWhited commented

2022-06-24 11:45:33 +00:00

Owner

Generally I would argue that writing a home grown parser is a bad idea, but unfortunately the encoding/xml package is somewhat poorly written compared to the rest of the standard library, and more or less unmaintained (it's extremely hard to get reviews for even small bug fixes). To this end I have been experimenting with a custom XML parser, and would like to get community feedback. Benefits to maintaining our own include:

It can be limited to the small subset of XML used by XMPP
Bug fixes and patches can be merged quicker
We can make API changes, for example it can be made to be entirely token based (you could encode a struct to tokens, not just to wire representation)

The downsides, however, are pretty major:

Fewer eyes on the code
A much larger (and more foundational) footprint for security problems
Lots more maintenance overhead

I am posting this issue as a place for the users to discuss whether it's a good idea to write/use our own parser. I am not convinced either way at this point. Other suggestions are also welcome.

Generally I would argue that writing a home grown parser is a bad idea, but unfortunately the `encoding/xml` package is somewhat poorly written compared to the rest of the standard library, and more or less unmaintained (it's extremely hard to get reviews for even small bug fixes). To this end I have been experimenting with a custom XML parser, and would like to get community feedback. Benefits to maintaining our own include: - It can be limited to the small subset of XML used by XMPP - Bug fixes and patches can be merged quicker - We can make API changes, for example it can be made to be entirely token based (you could encode a struct to tokens, not just to wire representation) The downsides, however, are pretty major: - Fewer eyes on the code - A much larger (and more foundational) footprint for security problems - Lots more maintenance overhead I am posting this issue as a place for the users to discuss whether it's a good idea to write/use our own parser. I am not convinced either way at this point. Other suggestions are also welcome.