xmldom 0.8.12

0.8.12
Fixed 1
  • Preserve trailing whitespace in ProcessingInstruction data
Security 2
  • createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec
  • XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods

From xmldom

Commits

Fixed
  • preserve trailing whitespace in ProcessingInstruction data #962 / #42
  • Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
  • Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @thesmartshadow, @stevenobiajulu, for your contributions

https://github.com/xmldom/xmldom/discussions/357

View original

Upgraded? How did it go?

Discussion