xmldom 0.9.11

0.9.11
Fixed 1
  • CharacterData nodeValue and data are now kept in sync
Security 2
  • XMLSerializer.serializeToString() now rejects invalid element and attribute names when requireWellFormed is true, throwing InvalidStateError for names that are not valid XML QNames, preventing XML injection via createElement() and setAttribute()
  • Processing-instruction grammar regex no longer backtracks quadratically on unterminated processing instructions, preventing denial-of-service attacks reachable from DOMParser.parseFromString()

From xmldom

Commits

Fixed
  • Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
  • Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
  • CharacterData nodeValue and data are now kept in sync #990
Chore
  • updated dependencies

Thank you, @bhaswanthc, @jmestwa-coder, @stevenobiajulu, for your contributions

View original

Upgraded? How did it go?

Discussion