Parsing xml in Go

Question

I'd like to parse bits of XML structured like those in the example. I keep running into values being empty. This is a simplified version of what I'm working with, just to show the issue.

package main

import (
        "encoding/xml"
        "fmt"
)

type Entry struct {
        VulnCveId   string  `xml:"entry>vuln:cve-id"`
}

func main() {
        v := Entry{}
        err := xml.Unmarshal([]byte(data), &v)
        if err != nil {
                fmt.Printf("error: %v", err)
                return
        }

        fmt.Println(v.VulnCveId)
}

const data = `
  <entry id="CVE-2005-4895">
    <vuln:vulnerable-configuration id="http://nvd.nist.gov/">
      <cpe-lang:logical-test negate="false" operator="OR">
        <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.3" />
        <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.2" />
        <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.1" />
      </cpe-lang:logical-test>
    </vuln:vulnerable-configuration>
    <vuln:vulnerable-software-list>
      <vuln:product>cpe:/a:csilvers:gperftools:0.3</vuln:product>
      <vuln:product>cpe:/a:csilvers:gperftools:0.1</vuln:product>
      <vuln:product>cpe:/a:csilvers:gperftools:0.2</vuln:product>
    </vuln:vulnerable-software-list>
    <vuln:cve-id>CVE-2005-4895</vuln:cve-id>
    <vuln:published-datetime>2012-07-25T15:55:01.273-04:00</vuln:published-datetime>
    <vuln:last-modified-datetime>2012-08-09T00:00:00.000-04:00</vuln:last-modified-datetime>
    <vuln:cvss>
      <cvss:base_metrics>
        <cvss:score>5.0</cvss:score>
        <cvss:access-vector>NETWORK</cvss:access-vector>
        <cvss:access-complexity>LOW</cvss:access-complexity>
        <cvss:authentication>NONE</cvss:authentication>
        <cvss:confidentiality-impact>NONE</cvss:confidentiality-impact>
        <cvss:integrity-impact>NONE</cvss:integrity-impact>
        <cvss:availability-impact>PARTIAL</cvss:availability-impact>
        <cvss:source>http://nvd.nist.gov</cvss:source>
        <cvss:generated-on-datetime>2012-07-26T08:38:00.000-04:00</cvss:generated-on-datetime>
      </cvss:base_metrics>
    </vuln:cvss>
    <vuln:cwe id="CWE-189" />
    <vuln:references xml:lang="en" reference_type="UNKNOWN">
      <vuln:source>MISC</vuln:source>
      <vuln:reference href="http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/" xml:lang="en">http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/</vuln:reference>
    </vuln:references>
    <vuln:references xml:lang="en" reference_type="UNKNOWN">
      <vuln:source>CONFIRM</vuln:source>
      <vuln:reference href="http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog" xml:lang="en">http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog</vuln:reference>
    </vuln:references>
    <vuln:summary>Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.</vuln:summary>
  </entry>
`

v.VulnCveId is empty in this instance. What am I doing wrong?

Phil Kulak · Accepted Answer · 2014-03-26 22:34:36Z

2

The problem is that you don't have a namespace. You have a prefix, "vuln", but it's not declared anywhere. It's actually not even valid XML.

Make the first line this:

<entry xmlns:vuln="http://my-namespace.com" id="CVE-2005-4895">

then make your struct tag this

`xml:"entry>http://my-namespace.com cve-id"`

and you should be good to go.

answered Mar 26, 2014 at 22:34

Phil Kulak

7,2608 gold badges47 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

VonC · Accepted Answer · 2012-08-17 21:29:43Z

1

Note: the same query without the namespace: http://play.golang.org/p/Gh5WltGzw3

VulnCveId   string  `xml:"cve-id"`

That will return a non-empty v.VulnCveId.

answered Aug 17, 2012 at 21:29

VonC

1.4m569 gold badges4.8k silver badges5.7k bronze badges

1 Comment

cmhobbs Over a year ago

any idea why the namespace is ignored?

xiaoye · Accepted Answer · 2012-08-22 09:02:19Z

1

VulnCveId string xml:"vuln cve-id" this can also work namespace use space instead of colon

answered Aug 22, 2012 at 9:02

xiaoye

594 bronze badges

Comments

Jeremy Wall · Accepted Answer · 2012-08-17 20:35:25Z

0

This looks like a bug almost to me.

http://play.golang.org/p/ym8zshlUC6 Working reduced case if I remove the entry> portion of your tag. which shouldn't be necessary according to the docs.
http://play.golang.org/p/3zt09n5fYa But doing the same thing for your code doesn't work so this definitely smells fishy.

answered Aug 17, 2012 at 20:35

Jeremy Wall

25.6k5 gold badges59 silver badges75 bronze badges

2 Comments

cmhobbs Over a year ago

I posted to the golang-nuts google group to see if this may be the case.

cmhobbs Over a year ago

It looks like the namespace separator is actually a space rather than a colon, so something like xml:"vuln cve-id" works. Accepting this answer because it matches the other, but you were first to post.

Collectives™ on Stack Overflow

Parsing xml in Go

4 Answers 4

Comments

1 Comment

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

1 Comment

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related