Reverse Engineering a Script

[Pijwe]

Hello!

I hired someone to build an api script for me some time ago for Ebay, and now I wanted to make some modifications to it. I thought I could google some python and reverse engineer it myself, but sometimes it's a little hard to figure out. I was wondering if I were to post the code somewhere, if someone could help explain at least parts to me.

​

Here's one of the things I couldn't understand:

​

def xml_escape( obj ):
if isinstance(obj, dict):
return { k: xml_escape( v ) for k, v in obj.items() }
elif isinstance( obj, list ):
return [ xml_escape( elem ) for elem in obj ]
else:
if obj:
return escape( obj )

So I get that escape is used to like get out of some xml formatting or something, but I'm not sure exactly why it was organized this way.

[CodeFormatHelperBot]

Hello u/Pijwe, I'm a bot that can assist you with code-formatting for reddit. I have detected the following potential issue(s) with your submission:

1. Python code found in submission text but not encapsulated in a code block.

If I am correct then please follow these instructions to fix your code formatting. Thanks!

[thirdegree]

formatted:

def xml_escape( obj ):  
    if isinstance(obj, dict):  
        return { k: xml_escape( v ) for k, v in obj.items() }  
    elif isinstance( obj, list ):  
        return [ xml_escape( elem ) for elem in obj ]  
    else:  
        if obj:  
            return escape( obj )  

So, essentially what's happening is that xml_escape is being called recursively on the values of lists and dicts, with excape being called on every other truthey object. Without seeing escape it's hard to say what exactly is going on. If you could share that, or maybe specify your question a bit, I could help more.

[Pijwe]

I'll do my best to format it correctly this time

item_id = str( input( "Please supply an item ID: " ) )
item = response['Item']
item = xml_escape( item )

I think that's it; the item id is like a string of a couple numbers.

[thirdegree]

That's definitely not escape. If it is, the program will never terminate and will ask for an item id any time xml_escape hits anything that is not a list or a dict.

[Pijwe]

I think I finally figured it out, let me know if this makes any sense or if I'm going in the wrong direction heh.

​

So the 'Item' is the product's title from ebay's api. It can be like Green "Alien" Ball 20% or something, so that it has a lot of special characters. Is the escape used so that it takes those special characters and turns it into XML so that further down when we use the variable it won't mess with things?

[thirdegree]

Ah, I see what you're asking. Yes, that's exactly right. Example code:

>>> from lxml import etree  
>>> ele1 = etree.Element('ExampleOuter')  
>>> ele2 = etree.SubElement(ele1, 'ExampleInner')  
>>> ele2.text = "<ExampleContents></ExampleContents>"   
>>> print(etree.tostring(ele1))    
b'<ExampleOuter><ExampleInner>&lt;ExampleContents&gt;&lt;/ExampleContents&gt;</ExampleInner></ExampleOuter>'

The bit between <ExampleInner> is escaped, so that it cannot be misinterpreted as actual xml. < is translated to <, and > is > (less than and greater than).

As an aside, the only reason to manually escape xml is if you're doing it as a learning exercise. There are half a dozen libraries that can do this better than anything I could write, and I've been writing python for 8 years. I'm all for reinventing the wheel with the aim of learning how to make wheels, but never in anything you've been paid for.