From 828298ca5969fa7e62901fd79ab24876c1f317ed Mon Sep 17 00:00:00 2001
From: Randy Reddig <randy@alta.software>
Date: Mon, 27 Sep 2021 00:15:58 -0400
Subject: [PATCH] encoding/xml: (*Decoder).nsname now strictly parses
 namespaces

---
 src/encoding/xml/xml.go | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go
index 462a99f83bfc5b..dda743e8a15139 100644
--- a/src/encoding/xml/xml.go
+++ b/src/encoding/xml/xml.go
@@ -1211,17 +1211,18 @@ func (d *Decoder) nsname() (name Name, ok bool) {
 	if !ok {
 		return
 	}
-	if strings.Count(s, ":") > 1 {
+	n := strings.Count(s, ":")
+	if n == 0 { // No colons, no namespace. OK.
 		name.Local = s
-	} else if i := strings.Index(s, ":"); i < 1 || i > len(s)-2 {
+	} else if n > 1 { // More than one colon, not OK.
 		name.Local = s
+		return name, false
+	} else if i := strings.Index(s, ":"); i < 1 || i > len(s)-2 { // Leading or trailing colon, not OK.
+		name.Local = s
+		return name, false
 	} else {
 		name.Space = s[0:i]
-		if strings.Contains(s[i+1:], ":") {
-			return name, false
-		} else {
-			name.Local = s[i+1:]
-		}
+		name.Local = s[i+1:]
 	}
 	return name, true
 }