encoding/xml: treat a namespaced name as two names, not one

An XML QName is syntactically two Names separated by a colon, rather
than a single name that has a colon in it.  This fixes multiple bugs in
XML QName reading.

Fixes: #68294
Fixes: #68392
Fixes: #68393

Author: DemiMarie

src/encoding/xml/xml.go

@@ -1169,15 +1169,28 @@ func (d *Decoder) nsname() (name Name, ok bool) {
 	if !ok {
 		return
 	}
-	if strings.Count(s, ":") > 1 {
-		return name, false
-	} else if space, local, ok := strings.Cut(s, ":"); !ok || space == "" || local == "" {
+	// XML does not allow a document to end with a name, so there must
+	// be another byte.
+	b, ok := d.mustgetc()
+	if !ok {
+		return
+	}
+	if b != ':' {
+		d.ungetc(b)
 		name.Local = s
-	} else {
-		name.Space = space
-		name.Local = local
+		return
 	}
-	return name, true
+	n, ok := d.name()
+	if ok {
+		// give a better error message than would otherwise be possible
+		if d.nextByte == ':' {
+			d.err = d.syntaxError("colon after prefixed XML name " + string(s) + ":" + string(n))
+			return name, false
+		}
+		name.Space = s
+		name.Local = n
+	}
+	return
 }
 
 // Get name: /first(first|second)*/
@@ -1229,7 +1242,7 @@ func isNameByte(c byte) bool {
 	return 'A' <= c && c <= 'Z' ||
 		'a' <= c && c <= 'z' ||
 		'0' <= c && c <= '9' ||
-		c == '_' || c == ':' || c == '.' || c == '-'
+		c == '_' || c == '.' || c == '-'
 }
 
 func isName(s []byte) bool {
@@ -1287,7 +1300,6 @@ func isNameString(s string) bool {
 
 var first = &unicode.RangeTable{
 	R16: []unicode.Range16{
-		{0x003A, 0x003A, 1},
 		{0x0041, 0x005A, 1},
 		{0x005F, 0x005F, 1},
 		{0x0061, 0x007A, 1},

src/encoding/xml/xml_test.go

@@ -31,6 +31,89 @@ func (t *toks) Token() (Token, error) {
 	return tok, nil
 }
 
+func TestDecodeBadName(t *testing.T) {
+	tests := []struct {
+		name    string
+		invalid string
+		message string
+	}{
+		{
+			name:    "Number after colon",
+			invalid: `<a:1/>`,
+			message: "invalid XML name: 1",
+		},
+		{
+			name:    "Two colons at end",
+			invalid: `<a::/>`,
+			message: "expected element name after <",
+		},
+		{
+			name:    "Two colons together in middle",
+			invalid: "<a::a/>",
+			message: "expected element name after <",
+		},
+		{
+			name:    "Colon at end",
+			invalid: "<a:/>",
+			message: "expected element name after <",
+		},
+		{
+			name:    "Colon at start",
+			invalid: "<:a/>",
+			message: "expected element name after <",
+		},
+		{
+			name:    "Number after colon in attribute",
+			invalid: `<a a:1=""/>`,
+			message: "invalid XML name: 1",
+		},
+		{
+			name:    "Two colons separate",
+			invalid: `<a a:b:c="1"/>`,
+			message: "colon after prefixed XML name a:b",
+		},
+		{
+			name:    "Two colons at end",
+			invalid: `<a a::="1"/>`,
+			message: "expected attribute name in element",
+		},
+		{
+			name:    "Two colons together in middle",
+			invalid: `<a a::a="1"/>`,
+			message: "expected attribute name in element",
+		},
+		{
+			name:    "Colon at end",
+			invalid: `<a a:="1"/>`,
+			message: "expected attribute name in element",
+		},
+		{
+			name:    "Colon at start",
+			invalid: `<a :a="1"/>`,
+			message: "expected attribute name in element",
+		},
+	}
+	for i, j := range tests {
+		t.Run(j.name, func(t *testing.T) {
+			d := NewDecoder(strings.NewReader(j.invalid))
+			tok, err := d.RawToken()
+			if tok != nil {
+				t.Fatalf("%d: d.Decode: expected nil token, got %#v", i, tok)
+			}
+			if err == nil {
+				t.Fatalf("%d: d.Decode: expected non-nil error, got nil", i)
+			}
+			syntaxError, ok := err.(*SyntaxError)
+			if !ok {
+				t.Fatalf("%d: d.Decode: expected syntax error", i)
+			}
+			if syntaxError.Msg != j.message {
+				t.Errorf("%d: bad message: expected %q, got %q", i, j.message, syntaxError.Msg)
+			}
+		})
+	}
+}
+
 func TestDecodeEOF(t *testing.T) {
 	start := StartElement{Name: Name{Local: "test"}}
 	tests := []struct {
@@ -1130,12 +1213,12 @@ func TestIssue20396(t *testing.T) {
 		wantErr error
 	}{
 		{`<a:te:st xmlns:a="abcd"/>`, // Issue 20396
-			UnmarshalError("XML syntax error on line 1: expected element name after <")},
+			UnmarshalError("XML syntax error on line 1: colon after prefixed XML name a:te")},
 		{`<a:te=st xmlns:a="abcd"/>`, attrError},
 		{`<a:te&st xmlns:a="abcd"/>`, attrError},
 		{`<a:test xmlns:a="abcd"/>`, nil},
 		{`<a:te:st xmlns:a="abcd">1</a:te:st>`,
-			UnmarshalError("XML syntax error on line 1: expected element name after <")},
+			UnmarshalError("XML syntax error on line 1: colon after prefixed XML name a:te")},
 		{`<a:te=st xmlns:a="abcd">1</a:te=st>`, attrError},
 		{`<a:te&st xmlns:a="abcd">1</a:te&st>`, attrError},
 		{`<a:test xmlns:a="abcd">1</a:test>`, nil},
@@ -1324,7 +1407,6 @@ func testRoundTrip(t *testing.T, input string) {
 
 func TestRoundTrip(t *testing.T) {
 	tests := map[string]string{
-		"trailing colon":         `<foo abc:="x"></foo>`,
 		"comments in directives": `<!ENTITY x<!<!-- c1 [ " -->--x --> > <e></e> <!DOCTYPE xxx [ x<!-- c2 " -->--x ]>`,
 	}
 	for name, input := range tests {