XML Syntax Checker

// DOMParser never throws. Given broken input it returns a document whose
// root is <parsererror>, which is why so much code silently accepts XML
// that no other parser would take.
function checkXml(source) {
  const doc = new DOMParser().parseFromString(source, 'application/xml');
  const error = doc.querySelector('parsererror');
  if (!error) return { wellFormed: true, message: null };

  // The text is browser-specific. Firefox includes a line and column,
  // Chrome's wording differs, and neither exposes them as fields.
  return { wellFormed: false, message: error.textContent.trim() };
}

// Browsers do not resolve external entities, so XXE is not reachable here.
// Internal entity expansion is, so cap the input length before parsing:
//   if (source.length > 20_000_000) throw new Error('too large');

# lxml is the only common Python parser that keeps going after a syntax
# error and hands back the whole list rather than the first entry.
from lxml import etree

parser = etree.XMLParser(
    recover=True,            # keep parsing so error_log fills up
    resolve_entities=False,  # do not expand entities
    no_network=True,         # never fetch an external DTD
    load_dtd=False,
    huge_tree=False,         # keep libxml2's depth and expansion limits
)
etree.fromstring(source.encode('utf-8'), parser)

for entry in parser.error_log:
    print(f"line {entry.line}, column {entry.column}: {entry.message}")
if not parser.error_log:
    print('well-formed')

# Without recover=True, fromstring raises etree.XMLSyntaxError and
# e.position gives a (line, column) tuple for the first failure only.
# For untrusted input with the standard library, use defusedxml.

import javax.xml.XMLConstants;
import javax.xml.parsers.SAXParserFactory;
import org.xml.sax.InputSource;
import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.DefaultHandler;

SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
// Drop the next line only if your documents legitimately carry a DOCTYPE.
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

var reader = factory.newSAXParser().getXMLReader();
reader.setErrorHandler(new DefaultHandler() {
    @Override public void warning(SAXParseException e) { print("warning", e); }
    @Override public void error(SAXParseException e) { print("error", e); }
    @Override public void fatalError(SAXParseException e) throws SAXParseException {
        print("fatal", e);
        throw e;  // the specification requires processing to stop here
    }
    private void print(String kind, SAXParseException e) {
        System.err.printf("%s at line %d, column %d: %s%n",
            kind, e.getLineNumber(), e.getColumnNumber(), e.getMessage());
    }
});
reader.parse(new InputSource(new java.io.StringReader(source)));

using System.Xml;

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,  // no DTD, so no entity expansion
    XmlResolver = null,                      // never fetch anything
    MaxCharactersFromEntities = 1024 * 1024,
    MaxCharactersInDocument = 20L * 1024 * 1024,
    ConformanceLevel = ConformanceLevel.Document,
};

try
{
    using var reader = XmlReader.Create(new StringReader(source), settings);
    while (reader.Read()) { }   // pull every node; syntax errors surface here
    Console.WriteLine("well-formed");
}
catch (XmlException e)
{
    // LinePosition is the column, 1-based. Reading stops at this point.
    Console.Error.WriteLine(
        $"line {e.LineNumber}, column {e.LinePosition}: {e.Message}");
}

<?php
// libxml recovers internally, so libxml_get_errors() is the closest a PHP
// script gets to a full list rather than a first failure.
libxml_use_internal_errors(true);

$doc = new DOMDocument();
$doc->loadXML($source, LIBXML_NONET);   // NONET blocks external fetches

$errors = libxml_get_errors();
libxml_clear_errors();

foreach ($errors as $e) {
    $kind = $e->level === LIBXML_ERR_FATAL ? 'fatal' : 'error';
    fprintf(
        STDERR,
        "%s at line %d, column %d: %s\n",
        $kind,
        $e->line,
        $e->column,
        trim($e->message)
    );
}
exit($errors ? 1 : 0);

# xmllint ships with libxml2 and is already installed on most machines.
# --nonet stops it fetching a DTD the document points at.
xmllint --noout --nonet document.xml

# --recover keeps parsing after a failure, so you see more than the first.
xmllint --noout --nonet --recover document.xml

# Check a whole tree, one file at a time:
find . -name '*.xml' -print0 | xargs -0 -n1 xmllint --noout --nonet

# Exit status: 0 well-formed, 1 unclassified, 3 well-formedness error,
# 4 validation error against a DTD or schema.