For readers new to libexpat or "Expat":

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

There a multiple projects aiming to rewrite C-based libexpat in a safer language like Rust or Lean. So far I am aware of the following projects:

• expat-parity — Rust
• expat-rs — Rust
• lexpat — Lean
• libexpat-rust — Rust
• rexpat — Rust (archived)

Potentially it is only a matter of time until libexpat is replaced by a rewrite. Maybe in a year or two or five, C libexpat will be just a memory from a past time. We will see.

Because the topic is of wider interest, as the maintainer of libexpat I would like write down and share what I consider important in a non-C libexpat replacement with potential:

• A drop-in replacement C header (.h file) and shared library (.so file) with all public API functions working
• Graceful handling of out-of-memory situations rather than crashing.
• Sound protection against billion laughs attacks, parameter laughs attacks, and the many forms of quadratic runtime possible with parsing XML: not allowing denial of service while not rejecting benign documents of demanding formats like DocBook and DITA at the same time.
• External entities support available but disabled by default for security.
• A focus on security in general beyond memory safety.
• Implementing XML 1.0r5 instead of 1.0r4 or 1.1.
• Full support for DTD, parameter entities, general entities.
• Testing against both the XML spec and libexpat's test suite.
• Parsing speed that beats C-based libexpat compiled with Fil-C (because that already addresses memory safety without new code).
• Continuous bug and feature parity with C-based libexpat as long as libexpat has not been replaced.
• Sharing and discussing bugs found in libexpat with upstream.
• Maintaining the rewrite, not just building it.
• MIT licensing or something similarly liberal.

It would be great to have those taken into account.

Sebastian Pipping