16.5-dars: XML

<?xml version="1.0" encoding="UTF-8"?>
<katalog>
  <kitob id="1" til="uz">
    <nom>Oʻtkan kunlar</nom>
    <narx valyuta="UZS">45000</narx>
  </kitob>
</katalog>

<a>matn<b/>quyruq</a>

ildiz = ET.Element("katalog")
kitob = ET.SubElement(ildiz, "kitob", id="1")
ET.SubElement(kitob, "nom").text = "Sarob"
ET.indent(ildiz)                                  # chiroyli otstup (3.9+)
matn = ET.tostring(ildiz, encoding="unicode")     # str; encoding="utf-8" → bytes

<r xmlns="http://ex.uz/ns" xmlns:m="http://ex.uz/meta">
  <a m:id="7">x</a>
</r>

NS = {"": "http://ex.uz/ns", "m": "http://ex.uz/meta"}
r.find("a", NS)              # bo'sh prefiks ham ishlaydi (3.8+)

<!ENTITY lol0 "lol">
<!ENTITY lol1 "&lol0;&lol0;">     <!-- har daraja ikki baravar -->

<!ENTITY x SYSTEM "file:///etc/passwd">

for hodisa, elem in ET.iterparse(fayl, events=("end",)):
    if elem.tag == "yozuv":
        ishlash(elem)
        elem.clear()                              # ⭐ xotirani bo'shatish

import xml.etree.ElementTree as ET

ildiz = ET.fromstring(matn)                        # yoki ET.parse(fayl).getroot()
for kitob in ildiz.findall(".//kitob[@til='uz']"):
    print(kitob.get("id"), kitob.findtext("nom"))

NS = {"a": "http://ex.uz/ns"}
ildiz.find("a:element", NS)

yangi = ET.Element("root")
ET.SubElement(yangi, "item", id="1").text = "qiymat"
ET.indent(yangi)
matn = ET.tostring(yangi, encoding="unicode")

for _, elem in ET.iterparse(katta_fayl, events=("end",)):   # oqimli
    if elem.tag == "yozuv":
        ...; elem.clear()

nom fazosi bor: {uri}teg yoki namespaces=
katta fayl: iterparse + elem.clear()
ishonchsiz XML: defusedxml
belgilarni qo'lda ekranlamang
find None qaytarsa — avval nom fazosini tekshiring
tail ni unutmang (aralash kontent)

"""fromstring; find/findall/findtext; atributlar; XPath: shart, indeks, atribut; text va tail; Element ro'yxatga o'xshashligi."""

import xml.etree.ElementTree as ET

XML = """<?xml version="1.0" encoding="UTF-8"?>
<katalog>
  <kitob id="1" til="uz">
    <nom>Oʻtkan kunlar</nom>
    <muallif>Abdulla Qodiriy</muallif>
    <narx valyuta="UZS">45000</narx>
  </kitob>
  <kitob id="2" til="uz">
    <nom>Sarob</nom>
    <muallif>Abdulla Qahhor</muallif>
    <narx valyuta="UZS">38000</narx>
  </kitob>
  <kitob id="3" til="ru">
    <nom>Voyna i mir</nom>
    <muallif>Lev Tolstoy</muallif>
  </kitob>
</katalog>"""


def main() -> None:
    ildiz = ET.fromstring(XML)
    print(f"=== 1. Ildiz ===")
    print(f"  teg: {ildiz.tag}, bolalar soni: {len(ildiz)}")

    print("\n=== 2. Aylanish va atributlar ===")
    for kitob in ildiz.findall("kitob"):
        narx = kitob.findtext("narx", default="—")
        valyuta = kitob.find("narx").get("valyuta") if kitob.find("narx") is not None else ""
        print(f"  #{kitob.get('id')} [{kitob.get('til')}] {kitob.findtext('nom'):18} {narx} {valyuta}")

    print("\n=== 3. XPath ===")
    print(f"  barcha nomlar: {[e.text for e in ildiz.iterfind('.//nom')]}")
    muallif2 = ildiz.find(".//kitob[@id='2']/muallif")
    print(f"  id=2 muallifi: {muallif2.text}")
    print(f"  narxi bor kitoblar: {[k.get('id') for k in ildiz.findall('.//kitob[narx]')]}")
    uzbekcha = [k.findtext("nom") for k in ildiz.findall(".//kitob[@til='uz']")]
    print(f"  uzbekcha kitoblar: {uzbekcha}")
    print(f"  birinchi kitob nomi: {ildiz.find('kitob[1]/nom').text}")

    print("\n=== 4. Yo'q qiymatlar ===")
    ruscha = ildiz.find(".//kitob[@id='3']")
    print(f"  narx elementi: {ruscha.find('narx')}")
    print(f"  findtext sukut bilan: {ruscha.findtext('narx', default='narx korsatilmagan')}")

    print("\n=== 5. text va tail (aralash kontent) ===")
    aralash = ET.fromstring("<xat>Hurmatli <ism>Aziz</ism>, xush kelibsiz <b>Wisar</b> ga!</xat>")
    print(f"  text: {aralash.text!r}")
    for bola in aralash:
        print(f"  <{bola.tag}> text={bola.text!r} tail={bola.tail!r}")
    print(f"  butun matn: {''.join(aralash.itertext())!r}")


if __name__ == "__main__":
    main()

=== 1. Ildiz ===
  teg: katalog, bolalar soni: 3

=== 2. Aylanish va atributlar ===
  #1 [uz] Oʻtkan kunlar      45000 UZS
  #2 [uz] Sarob              38000 UZS
  #3 [ru] Voyna i mir        —

=== 3. XPath ===
  barcha nomlar: ['Oʻtkan kunlar', 'Sarob', 'Voyna i mir']
  id=2 muallifi: Abdulla Qahhor
  narxi bor kitoblar: ['1', '2']
  uzbekcha kitoblar: ['Oʻtkan kunlar', 'Sarob']
  birinchi kitob nomi: Oʻtkan kunlar

=== 4. Yo'q qiymatlar ===
  narx elementi: None
  findtext sukut bilan: narx korsatilmagan

=== 5. text va tail (aralash kontent) ===
  text: 'Hurmatli '
  <ism> text='Aziz' tail=', xush kelibsiz '
  <b> text='Wisar' tail=' ga!'
  butun matn: 'Hurmatli Aziz, xush kelibsiz Wisar ga!'

"""Element/SubElement bilan qurish; set; belgi ekranlash; indent; tostring; nom fazolari {uri}teg; namespaces= lug'at; register_namespace."""

import xml.etree.ElementTree as ET


def main() -> None:
    print("=== 1. Daraxt qurish ===")
    katalog = ET.Element("katalog", versiya="1.0")
    for id_, nom, narx in [(1, "Sarob", 38000), (2, "Kecha va kunduz", 42000)]:
        kitob = ET.SubElement(katalog, "kitob", id=str(id_))
        ET.SubElement(kitob, "nom").text = nom
        ET.SubElement(kitob, "narx", valyuta="UZS").text = str(narx)
    ET.indent(katalog, space="  ")
    print(ET.tostring(katalog, encoding="unicode"))

    print("=== 2. ⭐ Belgi ekranlash ===")
    izoh = ET.Element("izoh")
    izoh.text = "5 < 10 & \"tirnoq\" > belgilar"
    izoh.set("shart", "a < b")
    print(f"  {ET.tostring(izoh, encoding='unicode')}")
    qaytgan = ET.fromstring(ET.tostring(izoh, encoding="unicode"))
    print(f"  qaytib o'qilganda asl matn: {qaytgan.text!r}")

    print("\n=== 3. ⚠️ Nom fazolari — o'qish ===")
    ns_xml = """<hujjat xmlns="urn:iso:20022" xmlns:b="urn:bank:meta">
      <tranzaksiya b:id="TXN-7">
        <summa>1500000</summa>
      </tranzaksiya>
    </hujjat>"""
    ildiz = ET.fromstring(ns_xml)
    print(f"  ildiz.tag: {ildiz.tag}")
    print(f"  to'liq nom bilan: {ildiz.find('{urn:iso:20022}tranzaksiya') is not None}")
    NS = {"": "urn:iso:20022", "b": "urn:bank:meta"}
    tranzaksiya = ildiz.find("tranzaksiya", NS)
    print(f"  namespaces= lug'at bilan: summa={tranzaksiya.findtext('summa', namespaces=NS)}")
    print(f"  NS li atribut: {tranzaksiya.get('{urn:bank:meta}id')}")
    print(f"  find('tranzaksiya') NS siz: {ildiz.find('tranzaksiya')}  ← None, chunki NS hisobga olinmadi")

    print("\n=== 4. Nom fazosi bilan yozish ===")
    ET.register_namespace("", "urn:iso:20022")
    ET.register_namespace("b", "urn:bank:meta")
    yangi = ET.Element("{urn:iso:20022}hujjat")
    t = ET.SubElement(yangi, "{urn:iso:20022}tranzaksiya")
    t.set("{urn:bank:meta}id", "TXN-9")
    ET.SubElement(t, "{urn:iso:20022}summa").text = "2000000"
    print(ET.tostring(yangi, encoding="unicode"))


if __name__ == "__main__":
    main()

=== 1. Daraxt qurish ===
<katalog versiya="1.0">
  <kitob id="1">
    <nom>Sarob</nom>
    <narx valyuta="UZS">38000</narx>
  </kitob>
  <kitob id="2">
    <nom>Kecha va kunduz</nom>
    <narx valyuta="UZS">42000</narx>
  </kitob>
</katalog>
=== 2. ⭐ Belgi ekranlash ===
  <izoh shart="a &lt; b">5 &lt; 10 &amp; "tirnoq" &gt; belgilar</izoh>
  qaytib o'qilganda asl matn: '5 < 10 & "tirnoq" > belgilar'

=== 3. ⚠️ Nom fazolari — o'qish ===
  ildiz.tag: {urn:iso:20022}hujjat
  to'liq nom bilan: True
  namespaces= lug'at bilan: summa=1500000
  NS li atribut: TXN-7
  find('tranzaksiya') NS siz: None  ← None, chunki NS hisobga olinmadi

=== 4. Nom fazosi bilan yozish ===
<hujjat xmlns="urn:iso:20022" xmlns:b="urn:bank:meta"><tranzaksiya b:id="TXN-9"><summa>2000000</summa></tranzaksiya></hujjat>

"""Entity kengayishi (billion laughs) eksponensial o'sadi; tashqi entity (XXE) stdlib da hal qilinmaydi; tashqi DTD yuklanmaydi; iterparse + clear bilan oqimli tahlil."""

import xml.etree.ElementTree as ET


def billion_laughs(daraja: int) -> str:
    entitylar = "".join(f'  <!ENTITY lol{i} "&lol{i - 1};&lol{i - 1};">\n' for i in range(1, daraja + 1))
    return (f'<?xml version="1.0"?>\n<!DOCTYPE l [\n  <!ENTITY lol0 "lol">\n'
            f'{entitylar}]>\n<l>&lol{daraja};</l>')


def main() -> None:
    print("=== 1. ⚠️ Entity kengayishi (billion laughs) ===")
    for daraja in (4, 8, 12):
        ildiz = ET.fromstring(billion_laughs(daraja))
        print(f"  daraja {daraja:2}: {len('lol')}×2^{daraja} = {len(ildiz.text):6} belgi (XML manba ~{daraja + 4} qator)")
    print("  ⚠️ har daraja ikki baravar — 30-daraja gigabaytlarga yetadi (xotira DoS)")

    print("\n=== 2. ✅ XXE — tashqi entity hal qilinmaydi ===")
    xxe = ('<?xml version="1.0"?>\n<!DOCTYPE r [ <!ENTITY x SYSTEM "file:///maxfiy.txt"> ]>\n<r>&x;</r>')
    try:
        ET.fromstring(xxe)
    except ET.ParseError as xato:
        print(f"  tashqi entity: {str(xato).split(':')[0]}")
        print("  ⭐ fayl o'qilmadi — stdlib tashqi entity ni hal qilmaydi (XXE dan xavfsiz)")

    print("\n=== 3. ✅ Tashqi DTD yuklanmaydi ===")
    ext_dtd = '<?xml version="1.0"?>\n<!DOCTYPE r SYSTEM "http://mavjud-emas.invalid/x.dtd">\n<r>ok</r>'
    print(f"  tarmoqqa chiqmadi, natija: {ET.fromstring(ext_dtd).text}")

    print("\n=== 4. Xavfsiz yechim ===")
    print("  ishonchsiz XML uchun: pip install defusedxml")
    print("  import defusedxml.ElementTree as ET  → entity va DTD bloklanadi")

    print("\n=== 5. Oqimli tahlil (iterparse) ===")
    katta = "<lenta>" + "".join(f"<yozuv id='{i}'><ball>{i * 10}</ball></yozuv>" for i in range(1, 6)) + "</lenta>"
    import io
    jami = 0
    korilgan = []
    for hodisa, elem in ET.iterparse(io.StringIO(katta), events=("end",)):
        if elem.tag == "yozuv":
            jami += int(elem.findtext("ball"))
            korilgan.append(elem.get("id"))
            elem.clear()                          # ⭐ xotirani bo'shatish
    print(f"  qayta ishlangan yozuvlar: {korilgan}, jami ball: {jami}")
    print("  ⚠️ elem.clear() bo'lmasa butun daraxt xotirada to'planadi")


if __name__ == "__main__":
    main()

=== 1. ⚠️ Entity kengayishi (billion laughs) ===
  daraja  4: 3×2^4 =     48 belgi (XML manba ~8 qator)
  daraja  8: 3×2^8 =    768 belgi (XML manba ~12 qator)
  daraja 12: 3×2^12 =  12288 belgi (XML manba ~16 qator)
  ⚠️ har daraja ikki baravar — 30-daraja gigabaytlarga yetadi (xotira DoS)

=== 2. ✅ XXE — tashqi entity hal qilinmaydi ===
  tashqi entity: undefined entity &x;
  ⭐ fayl o'qilmadi — stdlib tashqi entity ni hal qilmaydi (XXE dan xavfsiz)

=== 3. ✅ Tashqi DTD yuklanmaydi ===
  tarmoqqa chiqmadi, natija: ok

=== 4. Xavfsiz yechim ===
  ishonchsiz XML uchun: pip install defusedxml
  import defusedxml.ElementTree as ET  → entity va DTD bloklanadi

=== 5. Oqimli tahlil (iterparse) ===
  qayta ishlangan yozuvlar: ['1', '2', '3', '4', '5'], jami ball: 150
  ⚠️ elem.clear() bo'lmasa butun daraxt xotirada to'planadi

"""RSS/Atom-ga o'xshash XML: nom fazolari, findtext sukut bilan, sana tahlili va saralash, aralash maydonlar, ichki hisobotga (JSON) aylantirish."""

import json
import xml.etree.ElementTree as ET
from datetime import datetime

RSS = """<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>Wisar Blog</title>
    <item>
      <title>Python 3.14 chiqdi</title>
      <link>https://wisar.uz/p/314</link>
      <pubDate>2026-09-15</pubDate>
      <dc:creator>Aziz</dc:creator>
      <category>python</category>
      <category>yangilik</category>
      <content:encoded>Yangi versiyada &lt;b&gt;bepul-tred&lt;/b&gt; rejimi bor.</content:encoded>
    </item>
    <item>
      <title>Type hints amaliyoti</title>
      <link>https://wisar.uz/p/types</link>
      <pubDate>2026-09-17</pubDate>
      <dc:creator>Malika</dc:creator>
      <category>python</category>
    </item>
    <item>
      <title>Sarlavhasiz qoralama</title>
      <pubDate>notogri-sana</pubDate>
    </item>
  </channel>
</rss>"""

NS = {"content": "http://purl.org/rss/1.0/modules/content/",
      "dc": "http://purl.org/dc/elements/1.1/"}


def sana_ol(matn: str | None) -> datetime | None:
    if not matn:
        return None
    try:
        return datetime.strptime(matn.strip(), "%Y-%m-%d")
    except ValueError:
        return None


def maqola_ol(item: ET.Element) -> dict:
    sana = sana_ol(item.findtext("pubDate"))
    return {
        "sarlavha": (item.findtext("title") or "").strip() or "(sarlavhasiz)",
        "havola": item.findtext("link"),
        "sana": sana.date().isoformat() if sana else None,
        "muallif": item.findtext("dc:creator", namespaces=NS),
        "teglar": [c.text for c in item.findall("category")],
        "kontent_bormi": item.find("content:encoded", NS) is not None,
    }


def main() -> None:
    ildiz = ET.fromstring(RSS)
    kanal = ildiz.find("channel")
    print(f"=== 1. Lenta: {kanal.findtext('title')} ===")
    itemlar = kanal.findall("item")
    print(f"  jami maqolalar: {len(itemlar)}")

    maqolalar = [maqola_ol(item) for item in itemlar]

    print("\n=== 2. Muammoli maqolalar ===")
    for m in maqolalar:
        muammolar = []
        if m["sarlavha"] == "(sarlavhasiz)":
            muammolar.append("sarlavha yo'q")
        if m["sana"] is None:
            muammolar.append("sana noto'g'ri")
        if m["havola"] is None:
            muammolar.append("havola yo'q")
        if muammolar:
            print(f"  ⚠️ {m['sarlavha']}: {', '.join(muammolar)}")

    print("\n=== 3. Sana bo'yicha saralangan (yangi birinchi) ===")
    yaroqli = sorted((m for m in maqolalar if m["sana"]), key=lambda m: m["sana"], reverse=True)
    for m in yaroqli:
        teglar = ", ".join(m["teglar"]) or "—"
        print(f"  {m['sana']}  {m['sarlavha']:26} [{teglar}] muallif: {m['muallif']}")

    print("\n=== 4. Aralash kontent ===")
    kontentli = ildiz.find(".//content:encoded", NS)
    print(f"  content:encoded matni: {kontentli.text!r}")

    print("\n=== 5. Ichki hisobot (JSON) ===")
    hisobot = {"manba": kanal.findtext("title"), "jami": len(maqolalar), "maqolalar": yaroqli}
    print(json.dumps(hisobot, ensure_ascii=False, indent=2))


if __name__ == "__main__":
    main()

=== 1. Lenta: Wisar Blog ===
  jami maqolalar: 3

=== 2. Muammoli maqolalar ===
  ⚠️ Sarlavhasiz qoralama: sana noto'g'ri, havola yo'q

=== 3. Sana bo'yicha saralangan (yangi birinchi) ===
  2026-09-17  Type hints amaliyoti       [python] muallif: Malika
  2026-09-15  Python 3.14 chiqdi         [python, yangilik] muallif: Aziz

=== 4. Aralash kontent ===
  content:encoded matni: 'Yangi versiyada <b>bepul-tred</b> rejimi bor.'

=== 5. Ichki hisobot (JSON) ===
{
  "manba": "Wisar Blog",
  "jami": 3,
  "maqolalar": [
    {
      "sarlavha": "Type hints amaliyoti",
      "havola": "https://wisar.uz/p/types",
      "sana": "2026-09-17",
      "muallif": "Malika",
      "teglar": [
        "python"
      ],
      "kontent_bormi": false
    },
    {
      "sarlavha": "Python 3.14 chiqdi",
      "havola": "https://wisar.uz/p/314",
      "sana": "2026-09-15",
      "muallif": "Aziz",
      "teglar": [
        "python",
        "yangilik"
      ],
      "kontent_bormi": true
    }
  ]
}

ildiz.find("tranzaksiya")                          # ❌ None
ildiz.find("tranzaksiya", {"": "urn:iso:20022"})   # ✅

ET.fromstring(tashqi_xml)                           # ⚠️ billion laughs
import defusedxml.ElementTree as ET                 # ✅ ishonchsiz manba uchun

ET.parse("500mb.xml")                               # ❌ xotira
for _, e in ET.iterparse("500mb.xml", events=("end",)):   # ✅
    if e.tag == "yozuv": ...; e.clear()

"".join(e.text for e in ildiz)                      # ❌ oraliq matn yo'qoladi
"".join(ildiz.itertext())                           # ✅

kitob.find("narx").text                             # ❌ AttributeError agar yo'q bo'lsa
kitob.findtext("narx", default="0")                 # ✅

elem.text = matn.replace("<", "&lt;")               # ❌ ikki marta ekranlanadi
elem.text = matn                                    # ✅ avtomatik

narx = kitob.get("narx") + 1000                     # ❌ str + int
narx = int(kitob.get("narx", "0")) + 1000           # ✅

ildiz.find("kitob[0]")                              # ❌ SyntaxError yoki bo'sh
ildiz.find("kitob[1]")                              # ✅ birinchi

import xml.etree.ElementTree as ET
r = ET.fromstring("<a x='1'><b>M</b><c/>T</a>")
1.  print(r.tag, r.get("x"))
2.  print(len(r))
3.  print(r.findtext("b"))
4.  print(r.find("c").text)
5.  print(r[1].tail)
6.  print(ET.tostring(ET.fromstring("<x>a&amp;b</x>"), encoding="unicode"))
7.  e = ET.Element("t"); e.text = "a<b"; print(ET.tostring(e, encoding="unicode"))
8.  print(ET.fromstring("<n xmlns='u'><m/></n>").find("m"))
9.  print(ET.fromstring("<n xmlns='u'><m/></n>").find("{u}m").tag)
10. print(ET.fromstring("<a><b/><b/></a>").findall("b").__len__())
11. print([x.text for x in ET.fromstring("<a><b>1</b><b>2</b></a>").iterfind("b")])
12. try:
        ET.fromstring("<a><b></a>")
    except ET.ParseError as e:
        print(type(e).__name__)

1.  def summa(xml_matn):
        r = ET.fromstring(xml_matn)
        return sum(k.find("narx").text for k in r.findall("kitob"))

2.  def ismlar(xml_fayl):
        r = ET.parse(xml_fayl).getroot()          # 300 MB fayl
        return [e.text for e in r.findall(".//ism")]

3.  def oqi(tashqi_xml):
        return ET.fromstring(tashqi_xml)          # foydalanuvchi yuborgan

4.  def topshiriq(r):                              # <hujjat xmlns="urn:x">
        return r.find("tranzaksiya").get("id")

5.  def yoz(sarlavha):
        e = ET.Element("item")
        e.text = "<b>" + sarlavha.replace("&", "&amp;") + "</b>"
        return ET.tostring(e, encoding="unicode")