Reading and writing XML

Namespaces: why find returns None

Real formats add a namespace: a long URL attached to every tag name, so that a <name> from one standard can't be confused with a <name> from another. It's usually declared once at the top with xmlns="...", and from then on it applies to every element silently. GPX, the format GPS watches record hikes in, works this way:

import xml.etree.ElementTree as ET

gpx = """<gpx xmlns="http://www.topografix.com/GPX/1/1" version="1.1" creator="trail-club">
  <trk>
    <name>Fern Hollow loop</name>
    <trkseg>
      <trkpt lat="45.5120" lon="-122.6587"><ele>120.0</ele></trkpt>
      <trkpt lat="45.5131" lon="-122.6601"><ele>134.5</ele></trkpt>
      <trkpt lat="45.5144" lon="-122.6612"><ele>129.0</ele></trkpt>
    </trkseg>
  </trk>
</gpx>"""

root = ET.fromstring(gpx)
print(root.tag)
print(root.find("trk"))                       # None: the real tag includes the namespace

NS = {"g": "http://www.topografix.com/GPX/1/1"}
print(root.find("g:trk/g:name", NS).text)
for pt in root.iterfind(".//g:trkpt", NS):
    print(float(pt.get("lat")), float(pt.get("lon")), float(pt.find("g:ele", NS).text))

The first print shows what's going on: ElementTree stores the tag as {http://www.topografix.com/GPX/1/1}gpx, the namespace in curly brackets, then the name. So find("trk") looks for a tag with no namespace and finds nothing. The fix is a small dictionary from a short prefix of your choice (g here) to the namespace URL, passed to find, findall and iterfind, with the prefix on every step of the path. .// means "at any depth below here". Attributes like lat usually have no namespace, so get("lat") works as before.

import xml.etree.ElementTree as ET

NS = {"g": "http://www.topografix.com/GPX/1/1"}


def track_points(gpx_text):
    root = ET.fromstring(gpx_text)
    return [(p.get("lat"), p.get("lon"), None) for p in root.findall("trkpt")]


gpx = """<gpx xmlns="http://www.topografix.com/GPX/1/1"><trk><trkseg>
  <trkpt lat="45.5120" lon="-122.6587"><ele>120.0</ele></trkpt>
  <trkpt lat="45.5131" lon="-122.6601"><ele>134.5</ele></trkpt>
</trkseg></trk></gpx>"""
print(track_points(gpx))

Writing XML

To produce XML, build the tree with ET.Element and ET.SubElement, then turn it into text with ET.tostring. Don't glue strings together: ElementTree escapes special characters for you, so a trail called "Rock & Roll" comes out as Rock & Roll and can't break the document. It's a rule that holds for every format: let the library handle the quoting, never string gluing.

Here's a sitemap, the file that tells search engines which pages a site has:

import xml.etree.ElementTree as ET

SM = "http://www.sitemaps.org/schemas/sitemap/0.9"
ET.register_namespace("", SM)            # write it as the default namespace, with no prefix

urlset = ET.Element(f"{{{SM}}}urlset")
for path, day in [("/trails/fern-hollow", "2025-06-14"), ("/trails/rock-&-roll", "2025-06-20")]:
    url = ET.SubElement(urlset, f"{{{SM}}}url")
    ET.SubElement(url, f"{{{SM}}}loc").text = "https://club.example" + path
    ET.SubElement(url, f"{{{SM}}}lastmod").text = day

ET.indent(urlset)                         # line breaks and spaces, for people reading it
print(ET.tostring(urlset, encoding="unicode"))

The tag names use the curly-bracket form, {namespace}name (in an f-string each literal bracket is doubled, so {{{SM}}} means a bracket, the namespace, a bracket). register_namespace controls how the namespace is written in the output, and encoding="unicode" returns a str instead of bytes. Notice the & in the second address.

import xml.etree.ElementTree as ET

SM = "http://www.sitemaps.org/schemas/sitemap/0.9"


def sitemap(pages):
    rows = "".join(f"<url><loc>https://club.example{p}</loc><lastmod>{d}</lastmod></url>" for p, d in pages)
    return f"<urlset>{rows}</urlset>"


print(sitemap([("/trails/fern-hollow", "2025-06-14")]))

XML from outside is untrusted

XML has features that a hostile file can abuse. An entity is a named piece of text defined at the top of a document and reused by name. One entity can be defined as ten copies of another, that one as ten of the next, and so on, so a file of a few hundred bytes expands to gigabytes in memory: the "billion laughs" attack. Other parsers will fetch an external entity from a URL or a local file path named in the document. That can leak files from the server or make it call internal addresses, an attack called XXE.

Python's own documentation warns that its XML modules aren't secure against maliciously built data. ElementTree doesn't fetch external entities, and recent versions of the Expat parser underneath it limit entity expansion. Still, the advice for anything you didn't write yourself is simple: parse it with defusedxml, a small package with the same interface (from defusedxml.ElementTree import fromstring) that refuses entity tricks outright. It's the XML version of a general rule: data from outside is guilty until proven innocent. And check sizes before parsing: a 2 GB upload shouldn't reach the parser at all.

import xml.etree.ElementTree as ET

NS = {"g": "http://www.topografix.com/GPX/1/1"}
gpx = """<gpx xmlns="http://www.topografix.com/GPX/1/1"><trk><name>Red Mesa climb</name><trkseg>
  <trkpt lat="45.40" lon="-122.50"><ele>210</ele></trkpt>
  <trkpt lat="45.41" lon="-122.51"><ele>260</ele></trkpt>
  <trkpt lat="45.42" lon="-122.52"><ele>245</ele></trkpt>
  <trkpt lat="45.43" lon="-122.53"><ele>330</ele></trkpt>
  <trkpt lat="45.44" lon="-122.54"><ele>395</ele></trkpt>
</trkseg></trk></gpx>"""

root = ET.fromstring(gpx)
name = root.find("g:trk/g:name", NS).text
heights = [float(e.text) for e in root.iterfind(".//g:trkpt/g:ele", NS)]
climb = sum(max(0, b - a) for a, b in zip(heights, heights[1:]))
print(name, heights, "climb:", climb, "m")