xmldom 0.9.9

0.9.9
Added 1
  • Implement ParentNode.children getter
Fixed 1
  • Correctly traverse ancestor chain in Node.contains
Security 2
  • createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec
  • XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods

From xmldom

Commits

Added
  • implement ParentNode.children getter #960 / #410
Fixed
  • Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
  • Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
  • correctly traverse ancestor chain in Node.contains #931

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore
  • updated dependencies

Thank you, @stevenobiajulu, @yoshi389111, @thesmartshadow, for your contributions

https://github.com/xmldom/xmldom/discussions/435

View original

Upgraded? How did it go?

Discussion