gh-139478: Add warning about lack of validation for xml.sax.saxutils.XMLGenerator

[sethmlarson]

• Issue: Add warning to xml.sax.saxutils.XMLGenerator about untrusted inputs #139478

---

📚 Documentation preview 📚: https://cpython-previews--139479.org.readthedocs.build/

[picnixz]

My comment got hidden because of the resolved conversation:

Also, I would instead put the warning after the class description (before the versionchanged). The rationale is that when reading the warning box, we still don't know what this class do.

[sethmlarson]

Thanks for the suggestion @picnixz, I've moved the warning in 4b4c15a

[sethmlarson]

@serhiy-storchaka I changed the warning to a note about intended usage here: cbe0c12 please take a look.

[hugovk]

Suggested change

	with SAX parser functions from the :mod:`!xml.sax` module. Using XMLGenerator
	on untrusted user inputs is not the intended use.
	with SAX parser functions from the :mod:`!xml.sax` module. Using
	:class:`!XMLGenerator` on untrusted user inputs is not the intended use.

[vstinner]

"is only intended to be used": Ok, but what are the consequences if the class is misused? It's unclear to me what are the risks.

[merwok]

XML injections: martinblech/xmltodict#377 (comment)

[serhiy-storchaka]

In this form it simply reiterates what was said in the previous paragraph.

Even if this was not intended, people use XMLGenerator for generating XML. If it worked for them, it is fine. They should be aware about pitfalls. But I suggest adding such notes/warnings in other places that are used to generate XML first or simultaneously with XMLGenerator. They all should use unified wording. We can keep a short reminder that this is not intended use of XMLGenerator, the rest of the note should be similar to other notes.

I propose also to add helpers to validate names (#139489). Since this is a new feature, we cannot refer it the documentation changes that will be backported, but keep in mind that we can add references later.