ISAPI "Invalid XML Content"

[murrayinglis]

For context, I am prototyping a python script to automate adding users to cameras, setting permissions, etc..

I am using the POST /ISAPI/Security/users endpoint with query params ?security=1&iv=b549f9750d5..... Full url string as http://<CAMERA_IP>/ISAPI/Security/users?security=1&iv=b549f9750d5...., depending on iv and camera IP.

From the successful web interface requests for adding a user to the camera and from referencing the API spec, I can see that the cURL command has the following body:

<?xml version="1.0" encoding="UTF-8"?><User><id>0</id><userName>9ef1acdbd753229c178c6f80a526a43e</userName><loginPassword>e7ffa70bc017b918b089da8558533a68</loginPassword><password>e7ffa70bc017b918b089da8558533a68</password><bondIpList><bondIp><id>1</id><ipAddress>0.0.0.0</ipAddress><ipv6Address>::</ipv6Address></bondIp></bondIpList><macAddress/><userLevel>Viewer</userLevel><attribute><inherent>false</inherent></attribute></User>

I am replicating this as closely as possible in my python script:

    user = (f'<?xml version="1.0" encoding="UTF-8"?>'
                 f'<User>'
                 f'<id>0</id>'
                 f'<userName>{encrypted_username.hex()}</userName>'
                 f'<loginPassword>{encrypted_login_password.hex()}</loginPassword>'
                 f'<password>{encrypted_password.hex()}</password>'
                 f'<bondIpList>'
                 f'<bondIp>'
                 f'<id>1</id>'
                 f'<ipAddress>0.0.0.0</ipAddress>'
                 f'<ipv6Address>::</ipv6Address>'
                 f'</bondIp>'
                 f'</bondIpList>'
                 f'<macAddress/>'
                 f'<userLevel>{user_level}</userLevel>'
                 f'<attribute>'
                 f'<inherent>false</inherent>'
                 f'</attribute>'
                 f'</User>')

But receiving this response:

<requestURL></requestURL>
<statusCode>6</statusCode>
<statusString>Invalid XML Content</statusString>
<subStatusCode>badParameters</subStatusCode>

From my understanding, this is an error raised before any decryption is done on the sensitive data. I believe I have matched the XML structure, so not sure how to debug here.