Prevent writing control characters into XML attributes in syndication feeds

[Jacob Walls]

The Security Team received a report about constructing a syndication feed item from invalid user input (a control character) breaking an entire feed by causing the XML document to be unparseable.

Control characters other than HT, LF, and CR are not valid in XML. The code path through the XML serializers was adjusted in #20197 to raise a ValueError for these characters, but we didn't cover the syndication app, which also uses SimplerXMLGenerator.

We closed the report since it involves unsanitized user input, but we could raise a nice ValueError (or subclass) to prevent silently writing invalid XML documents.

Thanks sy2n0 for the report.

[Jacob Walls]

​PR

[Jacob Walls <jacobtylerwalls@…>]

In 67c4075:

Fixed #37183 -- Prevented writing control characters into XML attributes.

SimplerXMLGenerator already rejected control characters (unsupported
in XML 1.0) in element content, but attribute values were written
unchecked, so unsanitized input could still produce an unparseable
XML document. The existing check now runs over attribute values in
startElement(). This covers both syndication feeds, where item data
may flow into attributes such as Atom category terms, and the XML
serializer, which wraps the error to identify the offending object.

[Jacob Walls <jacobtylerwalls@…>]

In aa8949b8:

[6.1.x] Fixed #37183 -- Prevented writing control characters into XML attributes.

SimplerXMLGenerator already rejected control characters (unsupported
in XML 1.0) in element content, but attribute values were written
unchecked, so unsanitized input could still produce an unparseable
XML document. The existing check now runs over attribute values in
startElement(). This covers both syndication feeds, where item data
may flow into attributes such as Atom category terms, and the XML
serializer, which wraps the error to identify the offending object.

Backport of 67c407585ccdc01b76d78e33c082f23d46346747 from main.