0.8.14
Security 1
- XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed: true is passed, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()
From xmldom
Fixed
- Security:
XMLSerializer.serializeToString()now also rejects invalid element and attribute names when{ requireWellFormed: true }is passed, throwingInvalidStateErrorfor a name that is not a valid XMLQName(this covers the namespace prefix, which surfaces in the element qualified name or in a synthesizedxmlns:declaration). This prevents XML injection viacreateElement()/setAttribute(), extending the existingrequireWellFormedchecks to the serialized name set.GHSA-w2rr-34g9-rvrjGHSA-4w3w-2rp5-g8jm
Thank you, @bhaswanthc, @jmestwa-coder, for your contributions