EVTXtract
EVTXtract copied to clipboard
Published
20 hours ago •
williballenthin
williballenthin
XMLSyntaxError: error parsing attribute name
INFO:evtxtract.carvers:Unknown exception processing record at 0x423129920
Traceback (most recent call last):
File "evtxtract/carvers.py", line 175, in extract_chunk_records
File "evtxtract/utils.py", line 48, in get_eid
File "evtxtract/utils.py", line 18, in to_lxml
File "src/lxml/lxml.etree.pyx", line 3213, in lxml.etree.fromstring (src/lxml/lxml.etree.c:79003)
File "src/lxml/parser.pxi", line 1848, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:118334)
File "src/lxml/parser.pxi", line 1729, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:116892)
File "src/lxml/parser.pxi", line 1063, in lxml.etree._BaseParser._parseUnicodeDoc (src/lxml/lxml.etree.c:110879)
File "src/lxml/parser.pxi", line 595, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:105102)
File "src/lxml/parser.pxi", line 706, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:106810)
File "src/lxml/parser.pxi", line 635, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:105664)
XMLSyntaxError: error parsing attribute name, line 30, column 103 (line 30)
source of the issue is a rogue < in the content of a string.
unfortunately, python-evtx does not correctly escape strings in sub-substitutions when assembling templates, so we can't currently fix this.
INFO:evtxtract.carvers:Unknown exception processing record at 0x423129920 Traceback (most recent call last): File "evtxtract/carvers.py", line 175, in extract_chunk_records File "evtxtract/utils.py", line 48, in get_eid File "evtxtract/utils.py", line 18, in to_lxml File "src/lxml/lxml.etree.pyx", line 3213, in lxml.etree.fromstring (src/lxml/lxml.etree.c:79003) File "src/lxml/parser.pxi", line 1848, in lxml.etree._parseMemoryDocument (src/lxml/lxml.etree.c:118334) File "src/lxml/parser.pxi", line 1729, in lxml.etree._parseDoc (src/lxml/lxml.etree.c:116892) File "src/lxml/parser.pxi", line 1063, in lxml.etree._BaseParser._parseUnicodeDoc (src/lxml/lxml.etree.c:110879) File "src/lxml/parser.pxi", line 595, in lxml.etree._ParserContext._handleParseResultDoc (src/lxml/lxml.etree.c:105102) File "src/lxml/parser.pxi", line 706, in lxml.etree._handleParseResult (src/lxml/lxml.etree.c:106810) File "src/lxml/parser.pxi", line 635, in lxml.etree._raiseParseError (src/lxml/lxml.etree.c:105664) XMLSyntaxError: error parsing attribute name, line 30, column 103 (line 30)
