xmldom 0.9.12

0.9.12
Fixed 1
  • DOMExceptions raised during parsing are now reported as a fatalError with the originating error preserved as the cause on the resulting ParseError
Security 11
  • Parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory by inheriting the in-scope namespace map through the prototype chain instead of copying it for every prefix-declaring element, preventing denial-of-service from DOMParser.parseFromString
  • Attribute de-duplication during parsing is now O(M) instead of O(M²) using a null-prototype membership index, preventing denial-of-service from a well-formed document with a hostile number of duplicate attributes
  • HTML raw-text parsing now matches closing tags case-insensitively and handles missing closing tags explicitly, preventing denial-of-service from output amplification
  • Malformed-input recovery is now linear instead of quadratic, with malformed tag-name scan terminating at an embedded < and Node.prototype.normalize() merging adjacent text nodes in O(K) instead of O(K²)
  • XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError to prevent XML injection
  • XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects case-insensitive xml, throwing InvalidStateError to prevent PI-target injection

From xmldom

Commits

Fixed
  • Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
  • Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
  • Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
  • Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
  • Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
  • Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
  • Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
  • Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
  • Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path. GHSA-3px3-54cx-rmw9
  • Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable error in XML, a warning in HTML) instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's onError handler. GHSA-6h8r-xr42-gp59
  • DOMExceptions raised during parsing are now reported as a fatalError, and the originating error is preserved as the cause on the resulting ParseError.
Chore
  • updated dependencies

Thank you, @ericchiang, @KarimTantawey, @bhaswanthc, @arpitjain099, @Paranoidgrinch, for your contributions

View original

Upgraded? How did it go?

Discussion