ixml parser: character data that no tag follows - #1233
Merged
larshp merged 1 commit intoSep 15, 2026
Merged
Conversation
The value branch took the offset of "<" without looking at whether there was one. When the document ends in character data there is none, and sy-subrc is ignored, so the offset of the PREVIOUS match still stood: * `parse( |hello| )` - no match had been made yet, so the offset was 0, the value was empty, lv_xml did not advance and the loop ran forever. The process ends in an out-of-memory abort, not in an error the caller sees. * `parse( |<root/>trail| )` and `parse( |<root><item>A| )` - the offset of the last tag stood, which reads past the end of the rest. None of the three is well-formed XML, but a truncated response or a file that is not XML at all reaches a parser as it stands, and a hang is the worst of the ways to say so. Now the rest of the document is the value when no "<" follows, so the loop advances in every case and ends. Tests: a document of character data only, character data behind the root element, and a document cut off inside an element. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TKSWLpid4QLV6XWAoPixbb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is wrong
The value branch of the parse loop takes the offset of the next
<withoutlooking at whether there was one,
src/ixml/cl_ixml.clas.locals_imp.abap:sy-subrcis ignored, so when the document ends in character data the offsetof the previous match still stands. Two ways that goes wrong:
None of the three is well-formed XML. But a truncated response, a file that
turns out to be HTML, or an error page where XML was expected all reach a
parser as they stand — and of all the ways to say "this is not a document",
hanging until the process dies is the worst one.
The change
When no tag follows, the rest of the document is the value. The loop advances
in every case and ends, and what was read before stays readable:
<root/>trailkeeps its root element,
<root><item>Akeeps theA.A well-formed document is untouched — its character data always ends at a
<,so the new branch is never reached.
Tests
parse_text_without_markup—hellois one text node, and the parsereturns (this is the test that used to hang)
parse_text_after_root—<root>…</root>tailstill has its root elementparse_unclosed_tag—<root><item>Akeeps the value that was readnpm testis green:abaplint: 0 issue(s) found, 735 file(s) analyzed, andthe full unit run passes.
Note
This says nothing about reporting the malformed document —
parse( )stillreturns 0 and
if_ixml_parser~num_errorsis still atodo. That is its ownchange; this one is about the loop that does not terminate.