xmldom 0.8.14

0.8.14
Security 1
  • XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed: true is passed, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()

From xmldom

Commits

Fixed
  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @bhaswanthc, @jmestwa-coder, for your contributions

View original

Upgraded? How did it go?

Discussion