Parse QTI items to rewrite them at publish instead of matching regexes

[rtibblesbot]

Closes #6235
Refs #6236
Refs #6240

Publish-time QTI item rewrites in utils/assessment/qti/media.py now parse the item with lxml and edit the tree, replacing the regex text substitutions.

• set_qti_item_language sets xml:lang on the real root, past prolog comments ([QTI] A QTI item with a comment quoting its root tag is published without the node's language #6235) and on a namespace-prefixed root (Published QTI item with a namespace-prefixed root gets no xml:lang #6236).
• rewrite_qti_media_paths remaps a src written as an entity or character reference ([QTI] A QTI item with an entity in a media src attribute is published with an unrewritten path #6240).
• rewrite_qti_sized_image_paths and strip_studio_attributes move to the same parse/serialize path.
• Published items are lxml's serialization, not the authored bytes; byte-for-byte tests now compare canonical XML.
• Malformed XML now raises; publish validates items against the schema before these run.
• An item that only parses under its declared encoding (e.g. ISO-8859-1) falls back to that reading, so a validated item still publishes.

🤖 Generated with Claude Code

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

🟡 Waiting for feedback Last updated: 2026-10-03 05:07 UTC

[rtibbles]

One question about continuing with a regex approach here.

[rtibbles]

Would it be better to just parse the XML at this point? Creating more and more sophisticated regex for all of these XML parsing operations just adds brittleness - how much does this really save us performance wise?

[rtibblesbot]

Agreed — switched to parsing in 3c453e2. The savings were negligible: ~80µs per item for all three rewrites, each parsing separately.

• Searched utils/assessment/ for regexes and string ops that read XML structure; 4 places matched in qti/media.py, all now parse with lxml: set_qti_item_language, strip_studio_attributes, rewrite_qti_media_paths, rewrite_qti_sized_image_paths.
• Regexes left only match attribute values (checksum filename, pixel length, srcset entries).
• Output is now re-serialized, so the author's formatting isn't kept byte-for-byte; tests assert on the parsed tree instead.

[rtibblesbot]

Outside this PR's scope — tracked in:

• [QTI] A QTI item declaring a non-UTF-8 encoding is published with garbled text #6283 [QTI] A QTI item declaring a non-UTF-8 encoding is published with garbled text

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks