XML Diff

// Browsers do not resolve external entities, so DOMParser is safe here. It
// does not throw on malformed input: it returns a document containing a
// <parsererror> element, which is why so much code accepts broken XML.
function parse(source, label) {
  const doc = new DOMParser().parseFromString(source, 'application/xml');
  const err = doc.querySelector('parsererror');
  if (err) throw new Error(label + ': ' + err.textContent.trim());
  return doc;
}

// Canonical text: two spaces per level, attributes sorted by name, empty
// elements written one way. This is what makes the comparison structural.
function canonicalise(node, depth, out) {
  const pad = '  '.repeat(depth);
  if (node.nodeType === Node.TEXT_NODE) {
    const t = node.data.trim();
    if (t) out.push(pad + t);
    return out;
  }
  if (node.nodeType !== Node.ELEMENT_NODE) return out;

  const attrs = Array.from(node.attributes)
    .sort((a, b) => a.name.localeCompare(b.name))
    .map((a) => ' ' + a.name + '="' + escapeAttr(a.value) + '"')
    .join('');

  const kids = Array.from(node.childNodes).filter(
    (c) =>
      c.nodeType === Node.ELEMENT_NODE ||
      (c.nodeType === Node.TEXT_NODE && c.data.trim() !== ''),
  );

  if (kids.length === 0) {
    out.push(pad + '<' + node.nodeName + attrs + '/>');
    return out;
  }
  out.push(pad + '<' + node.nodeName + attrs + '>');
  for (const c of kids) canonicalise(c, depth + 1, out);
  out.push(pad + '</' + node.nodeName + '>');
  return out;
}

function escapeAttr(s) {
  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
}

const left = canonicalise(parse(expected, 'expected').documentElement, 0, []);
const right = canonicalise(parse(actual, 'actual').documentElement, 0, []);
// Equality is now a string compare. For a rendered diff, feed the two arrays
// to a line differ; this page runs an LCS over exactly these lines.
console.log(left.join('\n') === right.join('\n') ? 'identical' : 'different');

from lxml import etree
import difflib

# resolve_entities=False and no_network=True are the two that matter: without
# them a payload from an untrusted source can read local files (XXE).
PARSER = etree.XMLParser(resolve_entities=False, no_network=True,
                         load_dtd=False, huge_tree=False)

def canonical_lines(path: str) -> list[str]:
    with open(path, 'rb') as fh:
        doc = etree.parse(fh, PARSER)

    # C14N 2.0 sorts attributes, normalises namespace declarations and writes
    # empty elements one way. strip_text drops insignificant whitespace, which
    # is what makes indentation irrelevant to the comparison. Note that it
    # strips whitespace inside mixed content too, which is lossy.
    canon = etree.canonicalize(etree.tostring(doc), strip_text=True)

    reparsed = etree.fromstring(canon.encode(), PARSER)
    etree.indent(reparsed, space='  ')          # lxml 4.5 and later
    return etree.tostring(reparsed, encoding='unicode').splitlines(keepends=True)

diff = difflib.unified_diff(
    canonical_lines('expected.xml'),
    canonical_lines('actual.xml'),
    fromfile='expected.xml',
    tofile='actual.xml',
)
for line in diff:
    print(line, end='')

// XMLUnit 2 compares trees, not lines, so it can tell you "attribute 'total'
// differs at /order[1]/total[1]" rather than showing two lines and leaving
// you to spot it.
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;
import org.xmlunit.builder.DiffBuilder;
import org.xmlunit.builder.Input;
import org.xmlunit.diff.DefaultNodeMatcher;
import org.xmlunit.diff.Diff;
import org.xmlunit.diff.ElementSelectors;

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setNamespaceAware(true);

Diff diff = DiffBuilder.compare(Input.fromFile("expected.xml"))
    .withTest(Input.fromFile("actual.xml"))
    .withDocumentBuilderFactory(dbf)
    .ignoreComments()
    .ignoreWhitespace()        // drops whitespace-only text nodes
    .normalizeWhitespace()     // collapses runs inside the text that remains
    // byNameAndText pairs repeated elements up by content rather than by
    // position, so a reordered list is not reported as every row changing.
    .withNodeMatcher(new DefaultNodeMatcher(ElementSelectors.byNameAndText))
    .checkForSimilar()         // "similar" ignores attribute order and prefixes
    .build();

if (diff.hasDifferences()) {
    diff.getDifferences().forEach(d -> System.out.println(d));
    System.exit(1);
}

using System.IO;
using System.Linq;
using System.Xml;
using System.Xml.Linq;

// Load() without LoadOptions.PreserveWhitespace drops insignificant
// whitespace, so indentation never reaches the comparison. Prohibiting DTDs
// and nulling the resolver closes XXE.
static XDocument LoadSafely(string path)
{
    var settings = new XmlReaderSettings
    {
        DtdProcessing = DtdProcessing.Prohibit,
        XmlResolver = null,
    };
    using var reader = XmlReader.Create(path, settings);
    return XDocument.Load(reader);
}

var expected = LoadSafely("expected.xml");
var actual = LoadSafely("actual.xml");

// XNode.DeepEquals already ignores attribute order. Element order is
// significant to it, as it is to XML itself.
if (XNode.DeepEquals(expected, actual))
{
    Console.WriteLine("Identical.");
    return;
}

// Not equal: write both out normalised so a text diff is readable.
static void SortAttributes(XElement e)
{
    var sorted = e.Attributes()
                  .OrderBy(a => a.Name.NamespaceName)
                  .ThenBy(a => a.Name.LocalName)
                  .ToList();
    e.RemoveAttributes();
    e.Add(sorted);
    foreach (var child in e.Elements()) SortAttributes(child);
}

SortAttributes(expected.Root!);
SortAttributes(actual.Root!);
File.WriteAllText("expected.norm.xml", expected.ToString());
File.WriteAllText("actual.norm.xml", actual.ToString());
Console.Error.WriteLine("Documents differ. Diff the two .norm.xml files.");

# xmllint ships with libxml2 and is almost certainly already installed.
# --c14n implements Canonical XML 1.0: attributes sorted, empty elements
# expanded to a start/end pair, namespace declarations normalised.
# --nonet stops it fetching a DTD the document points at.

xmllint --nonet --c14n expected.xml > /tmp/a.c14n
xmllint --nonet --c14n actual.xml   > /tmp/b.c14n

# C14N does not re-indent, so pretty-print afterwards or the whole document
# arrives on one line and the diff is useless. --format leaves an element
# alone when it contains text of its own, so mixed content is not reflowed.
xmllint --nonet --format /tmp/a.c14n > /tmp/a.xml
xmllint --nonet --format /tmp/b.c14n > /tmp/b.xml

diff -u /tmp/a.xml /tmp/b.xml
# Exit status 1 from diff means "they differ" and is not an error. Guard for
# it explicitly in CI, or set -e will kill the job on a successful comparison.

# C14N converts to UTF-8 and drops the XML declaration, so this will not tell
# you the two files declared different encodings. Check that with head -c 100.