Classify appearance templates by XML root

plugins/1c/parser/cas_payload.py

@@ -7,6 +7,9 @@ import hashlib
 import re
 from typing import Any
 
+
+XML_ROOT_RE = re.compile(r"^\s*(?:<\?xml[^>]*>\s*)?<([A-Za-z_][\w.-]*(?::[A-Za-z_][\w.-]*)?)\b")
+
 from .payload import collect_strings, decode_payload_lossless, encode_text, parse_brace_text, root_signature, scalar
 
 
@@ -483,6 +486,11 @@ def classify_payload(data: bytes, *, include_text: bool = False, include_tree: b
                 stream["text"] = declared_prefix["text"]
                 stream["text_preview"] = str(declared_prefix["text"] or "").replace("\x00", "")[:500]
     text = decoded.get("text")
+    xml_root = None
+    if isinstance(text, str):
+        match = XML_ROOT_RE.match(text.lstrip("\ufeff"))
+        if match:
+            xml_root = match.group(1).rsplit(":", 1)[-1]
     tree = None
     root = None
     base64_decoded: list[dict[str, Any]] = []
@@ -505,6 +513,7 @@ def classify_payload(data: bytes, *, include_text: bool = False, include_tree: b
         "sha1": sha1_hex(data),
         "payload_sha1": sha1_hex(bytes(payload)),
         "markers": markers,
+        **({"xml_root": xml_root} if xml_root else {}),
         "root": root,
         "role": classify_role(root_marker, markers, text, stream_blocks, base64_decoded),
         "strings_sample": strings_sample,