XML Expat parsing for the Lua programming language

LuaExpat

• Home
  • Overview
  • Status
  • Download
  • History
  • References
  • Credits
• Manual
  • Introduction
  • Building
  • Installation
  • Parser Objects
• Examples
• Additional parsers
  • Lua Object Model
  • Parse to table
  • Threat protection
• Project
  • Bug Tracker
  • Source code
  • Documentation
• License

Overview

LuaExpat is a SAX XML parser based on the Expat library.

LuaExpat is free software and uses the same MIT license as Lua 5.1.

Status

Current version is 1.5.2. It was developed for Lua 5.1 to Lua 5.4, and has been tested on Linux and MacOS X with Expat 2.4.0+.

Download

The package can be downloaded using LuaRocks, or from the Github repository.

Older LuaExpat releases can be downloaded from LuaForge page.

Binaries for Windows are bundled with the Lua for Windows project.

History

Version 1.5.2 [27/Jun/2024]

• Fix: threat protection works with documents that declare empty namespace URIs
• Chore: Add version 2.6.2 of libExpat to the CI matrix

Version 1.5.1 [03/Oct/2022]

• Fix: makefile no longer sets .lua files as executable
• Fix: makefile honors $RPM_OPT_FLAGS and $RPM_LD_FLAGS
• Chore: added BLA test

Version 1.5.0 [26/Aug/2022]

• warning: this update requires a minimum libExpat version of 2.4.0. Though at the time of writing a minimum version of 2.4.6 is recommended due to CVE's fixed in the intermediate versions.
• Added option "allowDTD" to the threat protection parser.
• Add configuration for Billion Laughs Attack prevention. This includes adding #include "expat_config.h", since these functions are conditionally included in the exposed API of Expat. This means that LuaExpat will now be compiled using the same options used to compile Expat itself.
• Expose Expat compile time constants (lxp._EXPAT_FEATURES), see Expat documentation.

Version 1.4.1 [01/Apr/2022]

• Fix bad buffer size calculation in threat parser

Version 1.4.0 [22/Mar/2022]

• Improved Lua version support (5.1 - 5.4)
• Fix memory leak when callbacks reference a parser object
• Expose Expat library version (lxp._EXPAT_VERSION)
• Added 'lxp.totable' module (thanks Tomás Guisasola Gorham)
• Fix integers being returned as floats on Lua 5.3+ (thanks Kim Alvefur)
• Fix XmlDecl callback can also return 'nil' for 'standalone'
• Many documentation updates
• Added triplet namespace setting (returnnstriplet)
• Added EntityDecl handler
• Added AttlistDecl handler
• Added ElementDecl handler
• Added SkippedEntity handler
• Added EndDoctypeDecl handler
• More tests and new test setup; Busted, LuaCheck, Github actions
• Improved finishing, multiple nil-calls no longer throw errors
• Fix 'lxp.lom' to properly handle input as function, table, or file
• Added option for namespace aware parsing to the 'lxp.lom' module
• Repository moved to lunarmodules
• Added threat protection parser (protects against excessively large inputs), with options for the 'lxp.lom' and 'lxp.totable' to use it.

Version 1.3.2 and Version 1.3.3

• These versions were from a different fork by Tomás Guisasola Gorham
• Both these versions are available from LuaRocks
• The work done there has been integrated in the 1.4.0 version

Version 1.3.0 [02/Apr/2014]

• Lua 5.2 support (thanks Tomás Guisasola Gorham)
• support for the XmlDecl handler
• add parser:getcurrentbytecount() (XML_GetCurrentByteCount)
• ability to disable CharacterData merging
• Makefile improvements (thanks Vadim Misbakh-Soloviov)

Version 1.2.0 [02/Jun/2011]

New maintainer: Matthew Wild

• support for the StartDoctypeDecl handler
• add parser:stop() to abort parsing inside a callback

Version 1.1.0 [05/Jun/2007]

• adapted to work on both Lua 5.0 and Lua 5.1
• updated to use Expat 2.0.0

Version 1.0.2 [23/Mar/2006]

• minor bugfix, lom correct module name is lxp.lom

Version 1.0.1 [06/Jun/2005]

• minor changes for compatibility with Expat version 1.95.8

Version 1.0 [2/Dec/2004]

Version 1.0 Beta [4/Apr/2004]

Version 1.0 Alpha [10/Dec/2003]

References

LuaExpat uses the Expat library. For details on the C API please refer to the article "Using Expat".

LuaExpat implements the SAX API.

Credits

Version 1.0 was designed by Roberto Ierusalimschy, André Carregal and Tomás Guisasola as part of the Kepler Project which holds its copyright. The implementation was coded by Roberto Ierusalimschy, based on a previous design by Jay Carlson.

LuaExpat development was sponsored by Fábrica Digital and FINEP.