gh-155397: Raise InvalidFileException for malformed XML plists

plistlib.load()/loads() is documented to raise InvalidFileException when
a file cannot be parsed, but _PlistParser.parse() called expat's
ParseFile() with no exception translation. Two classes of malformed XML
plist leaked the underlying exception instead:

* XML that is not well-formed raised xml.parsers.expat.ExpatError.
* An <?xml ... ?> declaration naming an encoding unknown to Python's
  codec registry raised LookupError.

Neither is a subclass of ValueError (InvalidFileException's base), so
callers following the documented contract did not catch them. Translate
both into InvalidFileException and add regression tests.

Author: jaideeppyne

Lib/plistlib.py

@@ -67,7 +67,7 @@
 import os
 import re
 import struct
-from xml.parsers.expat import ParserCreate
+from xml.parsers.expat import ExpatError, ParserCreate
 
 
 PlistFormat = enum.Enum('PlistFormat', 'FMT_XML FMT_BINARY', module=__name__)
@@ -185,7 +185,14 @@ def parse(self, fileobj):
         self.parser.EndElementHandler = self.handle_end_element
         self.parser.CharacterDataHandler = self.handle_data
         self.parser.EntityDeclHandler = self.handle_entity_decl
-        self.parser.ParseFile(fileobj)
+        try:
+            self.parser.ParseFile(fileobj)
+        except ExpatError as e:
+            raise InvalidFileException(str(e)) from e
+        except LookupError as e:
+            # An <?xml ... ?> declaration naming an encoding that Python's
+            # codec registry does not know raises LookupError from expat.
+            raise InvalidFileException(str(e)) from e
         return self.root
 
     def handle_entity_decl(self, entity_name, is_parameter_entity, value, base, system_id, public_id, notation_name):

Lib/test/test_plistlib.py

@@ -916,6 +916,20 @@ def test_load_invalid_file(self):
         with self.assertRaises(plistlib.InvalidFileException):
             plistlib.loads(b"these are not plist file contents")
 
+    def test_xml_plist_not_well_formed(self):
+        # gh-155397: a not-well-formed XML plist must raise the documented
+        # InvalidFileException, not a raw xml.parsers.expat.ExpatError.
+        with self.assertRaises(plistlib.InvalidFileException):
+            plistlib.loads(b"<plist><foo></bar></plist>", fmt=plistlib.FMT_XML)
+
+    def test_xml_plist_unknown_encoding(self):
+        # gh-155397: an <?xml ... ?> declaration naming an encoding that
+        # Python does not know must raise the documented InvalidFileException,
+        # not a raw LookupError.
+        data = b'<?xml version="1.0" encoding="BogusEncoding"?><plist></plist>'
+        with self.assertRaises(plistlib.InvalidFileException):
+            plistlib.loads(data, fmt=plistlib.FMT_XML)
+
     def test_modified_uid_negative(self):
         neg_uid = UID(1)
         neg_uid.data = -1  # dodge the negative check in the constructor

Misc/NEWS.d/next/Library/2026-08-21-17-45-42.gh-issue-155397.wet1xZ.rst

@@ -0,0 +1 @@
+:func:`plistlib.load` and :func:`plistlib.loads` now raise :exc:`plistlib.InvalidFileException` for XML plists that are not well-formed or that declare an unknown encoding, instead of leaking the underlying :exc:`~xml.parsers.expat.ExpatError` or :exc:`LookupError`.