An XML parser turns markup into a structure your program can use. Choose the processing model around the size of your input, the operations you need, and where the file comes from. Check syntax, document rules, and business meaning as separate steps.
Choose a tree or a stream
A tree API keeps nodes available for navigation and editing. That makes it convenient to find an item, inspect its siblings, and write an updated document. A streaming API reports events as it reads, which suits long sequences of independent records. Its memory advantage depends on your program releasing completed records.
| Need | Starting point | Check |
|---|---|---|
| Small editable document | Tree API | Peak memory and preservation of significant text. |
| Large sequence of records | Event or pull parser | Record boundaries, memory release, partial-output handling. |
| Input arrives in chunks | Incremental parser | Backpressure, deadlines, and incomplete final input. |
Python’s ElementTree documentation explains its tree and pull APIs. Incremental parsing can retain a tree: clearing an element may leave an empty child in its parent. Measure memory with realistic record counts. DOM and ElementTree also expose different operations; choose the API your code needs.
Run the namespace-aware example
The XML practice pack contains fictional inventory, an XSD schema, scripts, and expected results. Extract it into a private folder. You need Python 3.10 or later and lxml. Run the following from that folder; a virtual environment keeps these dependencies separate from other projects.
python -m pip install lxml
python parse_catalog.pyThe output is A1: Desk & Lamp (2) followed by B2: Notebook (3). The document uses the example namespace urn:yenra:catalog. The important lookup is:
ns = {"c": "urn:yenra:catalog"}
for item in root.findall("c:item", ns):
name = item.findtext("c:name", namespaces=ns)The query prefix c is a local shorthand. Matching depends on the namespace URI and local name. A query for plain item targets a different name and can return no results. Inspect the root name and namespace before deciding that a document contains no records.
Separate three kinds of correctness
Parsing establishes whether bytes can be read as XML. Schema validation checks a document contract. Application validation checks meaning, such as whether a stock code exists in your warehouse. Successful parsing alone establishes neither of the other two.
Run python validate_catalog.py, then python validate_catalog.py invalid-quantity.xml. The second command exits with an error because the quantity is negative. The pack also exercises missing names and repeated identifiers. lxml’s validation guide explains schema validation and diagnostics.
Report a failed document with a correlation ID and a useful line or field reference. Keep partial writes out of the destination until the required checks pass, or use an explicitly recoverable per-record transaction design. Preserve original inputs under your retention policy.
Set boundaries for outside input
The scripts are exercises for small local files. They cap input at 64 KiB, refuse document type declarations, and disable entity resolution, DTD loading, and network fetching. The size cap is a teaching limit, not a universal service setting. The bundled schemas and stylesheets are trusted local files.
For a service, add transport and decompression limits, execution budgets, and constrained outbound access. Review every stage that can load resources, including schemas and transformations. lxml resource resolution and access controls address distinct parts of that process.
Python’s XML security overview describes resource-exhaustion risks and runtime dependencies. Recheck assumptions after upgrades. The XML Firewall guide turns these boundaries into an acceptance-test plan.