Xml parsing in Go

Question

I would like to parse the XML bits structured as in the example. I continue to work in empty values. This is a simplified version of what I'm working with to show the problem.

package main import ( "encoding/xml" "fmt" ) type Entry struct { VulnCveId string `xml:"entry>vuln:cve-id"` } func main() { v := Entry{} err := xml.Unmarshal([]byte(data), &v) if err != nil { fmt.Printf("error: %v", err) return } fmt.Println(v.VulnCveId) } const data = ` <entry id="CVE-2005-4895"> <vuln:vulnerable-configuration id="http://nvd.nist.gov/"> <cpe-lang:logical-test negate="false" operator="OR"> <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.3" /> <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.2" /> <cpe-lang:fact-ref name="cpe:/a:csilvers:gperftools:0.1" /> </cpe-lang:logical-test> </vuln:vulnerable-configuration> <vuln:vulnerable-software-list> <vuln:product>cpe:/a:csilvers:gperftools:0.3</vuln:product> <vuln:product>cpe:/a:csilvers:gperftools:0.1</vuln:product> <vuln:product>cpe:/a:csilvers:gperftools:0.2</vuln:product> </vuln:vulnerable-software-list> <vuln:cve-id>CVE-2005-4895</vuln:cve-id> <vuln:published-datetime>2012-07-25T15:55:01.273-04:00</vuln:published-datetime> <vuln:last-modified-datetime>2012-08-09T00:00:00.000-04:00</vuln:last-modified-datetime> <vuln:cvss> <cvss:base_metrics> <cvss:score>5.0</cvss:score> <cvss:access-vector>NETWORK</cvss:access-vector> <cvss:access-complexity>LOW</cvss:access-complexity> <cvss:authentication>NONE</cvss:authentication> <cvss:confidentiality-impact>NONE</cvss:confidentiality-impact> <cvss:integrity-impact>NONE</cvss:integrity-impact> <cvss:availability-impact>PARTIAL</cvss:availability-impact> <cvss:source>http://nvd.nist.gov</cvss:source> <cvss:generated-on-datetime>2012-07-26T08:38:00.000-04:00</cvss:generated-on-datetime> </cvss:base_metrics> </vuln:cvss> <vuln:cwe id="CWE-189" /> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>MISC</vuln:source> <vuln:reference href="http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/" xml:lang="en">http://kqueue.org/blog/2012/03/05/memory-allocator-security-revisited/</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>CONFIRM</vuln:source> <vuln:reference href="http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog" xml:lang="en">http://code.google.com/p/gperftools/source/browse/tags/perftools-0.4/ChangeLog</vuln:reference> </vuln:references> <vuln:summary>Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.</vuln:summary> </entry> ` 

v.VulnCveId in this instance is empty. What am I doing wrong?

Answer 1

It seems like a mistake almost to me.

• http://play.golang.org/p/ym8zshlUC6 Dealing with a reduced case if I delete a part of an entry> of your tag. which should not be necessary in accordance with the documents.
• http://play.golang.org/p/3zt09n5fYa But doing the same for your code doesn't work, so it definitely smells fishy.

Answer 2

The problem is that you do not have a namespace. You have the prefix "vul", but it is not declared anywhere. This is actually not even the right XML.

Make the first line:

 <entry xmlns:vuln="http://my-namespace.com" id="CVE-2005-4895"> 

then make your structure tag this

 `xml:"entry>http://my-namespace.com cve-id"` 

and you should be good to go.

Answer 3

Note: the same query without namespace: http://play.golang.org/p/Gh5WltGzw3

 VulnCveId string `xml:"cve-id"` 

This will return a non-empty v.VulnCveId .

Answer 4

VulnCveId string xml:"vuln cve-id" this may also work in namespace instead of space