@flighthq/xml 0.3.0-next.906.07cea63 → 0.3.0

package/dist/xmlParse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xmlParse.d.ts","sourceRoot":"","sources":["../src/xmlParse.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;8EAC8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxE;AAED;;qEAEqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAY/D"}
+{"version":3,"file":"xmlParse.d.ts","sourceRoot":"","sources":["../src/xmlParse.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D;8EAC8E;AAC9E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxE;AAED;;qEAEqE;AACrE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAY/D"}

package/dist/xmlParse.js

@@ -1,8 +1,9 @@
 // Tree-building (DOM-style) XML parser sufficient for atlas and plist file formats.
 // Not a general-purpose XML parser, but handles namespaced/extra attributes and elements,
 // both double-quoted and single-quoted attribute values, XML entity escapes
-// (&amp; &lt; &gt; &quot; &apos; plus numeric references), XML comments (<!-- -->),
-// CDATA sections (<![CDATA[...]]>), the XML declaration, and DOCTYPE.
+// (&amp; &lt; &gt; &quot; &apos; plus numeric references), general entities declared in a DOCTYPE's
+// internal subset, XML comments (<!-- -->), CDATA sections (<![CDATA[...]]>), the XML declaration,
+// and DOCTYPE.
 /** Parse all attributes from an element's attribute string.
  *  Supports double-quoted and single-quoted values and XML entity escapes. */
 export function parseXmlAttributes(attrs) {
@@ -21,16 +22,20 @@ export function parseXmlAttributes(attrs) {
  *  Returns the root element, or null when the input contains no recognizable element.
  *  Does not validate DTD, namespaces, or processing instructions. */
 export function parseXmlDocument(xml) {
-    // Normalize: strip comments, process CDATA, normalize line endings
-    let src = stripCdata(stripXmlComments(xml)).replace(/\r\n?/g, '\n');
-    // Strip XML declaration and DOCTYPE (including an internal subset `[ ... ]`,
-    // whose contents may hold `>` characters the flat `[^>]*` form would stop at).
-    src = src
-        .replace(/<\?[\s\S]*?\?>/g, '')
-        .replace(/<!DOCTYPE[^>[]*(?:\[[\s\S]*?\][^>]*)?>/gi, '')
-        .trim();
-    return parseElement(src, { pos: 0 });
+    // Normalize: strip comments and normalize line endings.
+    let src = stripXmlComments(xml).replace(/\r\n?/g, '\n');
+    // Strip XML declaration and DOCTYPE before parsing the root element. The DOCTYPE is discarded but
+    // its internal subset is read on the way out, because a general entity's replacement text is markup
+    // and so has to be substituted into the source before the tree is built, not decoded out of a text
+    // node afterwards.
+    const entities = {};
+    src = stripXmlDoctypes(src.replace(/<\?[\s\S]*?\?>/g, ''), entities).trim();
+    return parseElement(expandXmlEntities(src, entities), { pos: 0 });
 }
+// An entity may nest a few levels legitimately; past that a document is recursing, not composing.
+const MAX_XML_ENTITY_PASSES = 8;
+const MAX_XML_ENTITY_GROWTH = 16;
+const MAX_XML_ENTITY_BUDGET = 65536;
 const XML_ENTITIES = {
     amp: '&',
     apos: "'",
@@ -38,13 +43,46 @@ const XML_ENTITIES = {
     lt: '<',
     quot: '"',
 };
+/**
+ * Substitutes declared general entities into the source ahead of parsing.
+ *
+ * A replacement may itself reference an entity, so expansion repeats until it settles. Both the pass
+ * count and the resulting size are capped: entities that reference each other are otherwise an
+ * exponential bomb ("billion laughs"), and the budget is what keeps a hostile document costing
+ * bounded work. Exhausting the budget stops expansion and keeps what resolved, since a partially
+ * expanded document still parses.
+ *
+ * Only the predefined five and declared general entities substitute. An undeclared reference is left
+ * alone for `decodeXmlEntities` to see as text.
+ */
+function expandXmlEntities(src, entities) {
+    let output = src;
+    const budget = src.length * MAX_XML_ENTITY_GROWTH + MAX_XML_ENTITY_BUDGET;
+    for (let pass = 0; pass < MAX_XML_ENTITY_PASSES; pass++) {
+        let expanded = false;
+        const next = output.replace(/&([\w:.-]+);/g, (reference, name) => {
+            const replacement = entities[name];
+            if (replacement === undefined)
+                return reference;
+            expanded = true;
+            return replacement;
+        });
+        if (!expanded || next.length > budget)
+            return output;
+        output = next;
+    }
+    return output;
+}
 function decodeXmlEntities(s) {
-    return s.replace(/&(?:#(\d+)|#x([\da-fA-F]+)|(\w+));/g, (_, dec, hex, name) => {
-        if (dec)
-            return String.fromCodePoint(parseInt(dec, 10));
-        if (hex)
-            return String.fromCodePoint(parseInt(hex, 16));
-        return XML_ENTITIES[name] ?? _;
+    return s.replace(/&(?:#(\d+)|#x([\da-fA-F]+)|(\w+));/g, (reference, dec, hex, name) => {
+        const numeric = dec ?? hex;
+        if (numeric !== undefined) {
+            const codepoint = parseInt(numeric, dec !== undefined ? 10 : 16);
+            if (codepoint > 0x10ffff || (codepoint >= 0xd800 && codepoint <= 0xdfff))
+                return reference;
+            return String.fromCodePoint(codepoint);
+        }
+        return XML_ENTITIES[name] ?? reference;
     });
 }
 function parseElement(src, state) {
@@ -109,6 +147,17 @@ function parseElement(src, state) {
                     content.push(decoded);
                 continue;
             }
+            if (src.slice(state.pos, state.pos + 9) === '<![CDATA[') {
+                const cdataStart = state.pos + 9;
+                const cdataEnd = src.indexOf(']]>', cdataStart);
+                const contentEnd = cdataEnd >= 0 ? cdataEnd : src.length;
+                const cdata = src.slice(cdataStart, contentEnd);
+                text += cdata.trim();
+                if (cdata !== '')
+                    content.push(cdata);
+                state.pos = cdataEnd >= 0 ? cdataEnd + 3 : src.length;
+                continue;
+            }
             // Check for closing tag
             if (src[state.pos + 1] === '/') {
                 // Skip to '>'
@@ -130,11 +179,82 @@ function skipWhitespace(src, state) {
     while (state.pos < src.length && /\s/.test(src[state.pos]))
         state.pos++;
 }
-function stripCdata(xml) {
-    // Replace CDATA with its raw content
-    return xml.replace(/<!\[CDATA\[[\s\S]*?]]>/g, (m) => m.slice(9, m.length - 3));
-}
 function stripXmlComments(xml) {
-    return xml.replace(/<!--[\s\S]*?-->/g, '');
+    let copyStart = 0;
+    let output = '';
+    let pos = 0;
+    while (pos < xml.length) {
+        if (xml.slice(pos, pos + 9) === '<![CDATA[') {
+            const cdataEnd = xml.indexOf(']]>', pos + 9);
+            pos = cdataEnd >= 0 ? cdataEnd + 3 : xml.length;
+            continue;
+        }
+        if (xml.slice(pos, pos + 4) !== '<!--') {
+            pos++;
+            continue;
+        }
+        output += xml.slice(copyStart, pos);
+        const commentEnd = xml.indexOf('-->', pos + 4);
+        pos = commentEnd >= 0 ? commentEnd + 3 : xml.length;
+        copyStart = pos;
+    }
+    return output + xml.slice(copyStart);
+}
+/**
+ * Removes every DOCTYPE, collecting the general entities its internal subset declares into `out`.
+ *
+ * Parameter entities (`<!ENTITY % name …>`) and external ones (`SYSTEM` / `PUBLIC`) are deliberately
+ * not collected: an external entity resolves a URL or a file path at parse time, which is a document
+ * reading whatever the process can reach, so the parser has no business honoring one.
+ */
+function stripXmlDoctypes(xml, out) {
+    let copyStart = 0;
+    let output = '';
+    let pos = 0;
+    while (pos < xml.length) {
+        if (xml[pos] !== '<' || xml.slice(pos, pos + 9).toLowerCase() !== '<!doctype') {
+            pos++;
+            continue;
+        }
+        output += xml.slice(copyStart, pos);
+        const doctypeStart = pos;
+        pos += 9;
+        let internalSubsetDepth = 0;
+        let quote = '';
+        while (pos < xml.length) {
+            const ch = xml[pos];
+            if (quote) {
+                if (ch === quote)
+                    quote = '';
+            }
+            else if (ch === '"' || ch === "'") {
+                quote = ch;
+            }
+            else if (ch === '[') {
+                internalSubsetDepth++;
+            }
+            else if (ch === ']' && internalSubsetDepth > 0) {
+                internalSubsetDepth--;
+            }
+            else if (ch === '>' && internalSubsetDepth === 0) {
+                pos++;
+                break;
+            }
+            pos++;
+        }
+        collectXmlEntityDeclarations(xml.slice(doctypeStart, pos), out);
+        copyStart = pos;
+    }
+    return output + xml.slice(copyStart);
+}
+// The name must be followed directly by a quoted replacement, which is what excludes both the
+// parameter form (a `%` where the name belongs) and the external form (a SYSTEM/PUBLIC keyword where
+// the quote belongs) without testing for either.
+function collectXmlEntityDeclarations(doctype, out) {
+    const declaration = /<!ENTITY\s+([\w:.-]+)\s*(?:"([^"]*)"|'([^']*)')\s*>/g;
+    let match;
+    while ((match = declaration.exec(doctype)) !== null) {
+        out[match[1]] = match[2] ?? match[3] ?? '';
+    }
 }
 //# sourceMappingURL=xmlParse.js.map

package/dist/xmlParse.js.map

@@ -1 +1 @@
-{"version":3,"file":"xmlParse.js","sourceRoot":"","sources":["../src/xmlParse.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0FAA0F;AAC1F,4EAA4E;AAC5E,oFAAoF;AACpF,sEAAsE;AAItE;8EAC8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,kEAAkE;IAClE,MAAM,EAAE,GAAG,2CAA2C,CAAC;IACvD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,mEAAmE;IACnE,IAAI,GAAG,GAAG,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEpE,6EAA6E;IAC7E,+EAA+E;IAC/E,GAAG,GAAG,GAAG;SACN,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,0CAA0C,EAAE,EAAE,CAAC;SACvD,IAAI,EAAE,CAAC;IAEV,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAMD,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,GAAG;IACT,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5E,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAiB;IAClD,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnE,kCAAkC;IAClC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc;IAE3B,+BAA+B;IAC/B,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5C,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;IAC5B,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE3B,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,EAAE,CAAC;QAC/B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM;QACR,CAAC;QACD,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;IAC3C,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAExD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,mCAAmC;QACnC,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM;gBAAE,MAAM;YAEnC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,YAAY;gBACZ,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;gBAC5B,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;gBACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,OAAO,KAAK,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,wBAAwB;YACxB,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,cAAc;gBACd,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;gBACrE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc;gBAC3B,MAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,KAAiB;IACpD,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,qCAAqC;IACrC,OAAO,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"xmlParse.js","sourceRoot":"","sources":["../src/xmlParse.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,0FAA0F;AAC1F,4EAA4E;AAC5E,oGAAoG;AACpG,mGAAmG;AACnG,eAAe;AAIf;8EAC8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,kEAAkE;IAClE,MAAM,EAAE,GAAG,2CAA2C,CAAC;IACvD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,wDAAwD;IACxD,IAAI,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAExD,kGAAkG;IAClG,oGAAoG;IACpG,mGAAmG;IACnG,mBAAmB;IACnB,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5E,OAAO,YAAY,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAMD,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,MAAM,YAAY,GAA2B;IAC3C,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,GAAG;IACT,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,IAAI,EAAE,GAAG;CACV,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,QAA0C;IAChF,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;IAC1E,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,EAAE,EAAE,CAAC;QACxD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAE;YAC/E,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAChD,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3F,OAAO,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAiB;IAClD,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEnE,kCAAkC;IAClC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc;IAE3B,+BAA+B;IAC/B,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5C,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,oBAAoB;IACpB,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;IAC5B,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE3B,8EAA8E;IAC9E,6EAA6E;IAC7E,8CAA8C;IAC9C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,EAAE,CAAC;QAC/B,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM;QACR,CAAC;QACD,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC;IAC3C,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;IAExD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,mCAAmC;QACnC,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM;gBAAE,MAAM;YAEnC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,YAAY;gBACZ,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;gBAC5B,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;gBACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,OAAO,KAAK,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACxD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;gBACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAChD,MAAM,UAAU,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACzD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAChD,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACrB,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtC,KAAK,CAAC,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,wBAAwB;YACxB,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,cAAc;gBACd,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;gBACrE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,cAAc;gBAC3B,MAAM;YACR,CAAC;YAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,KAAiB;IACpD,OAAO,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;YAC7C,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACvC,GAAG,EAAE,CAAC;YACN,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC/C,GAAG,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QACpD,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAA2B;IAChE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;YAC9E,GAAG,EAAE,CAAC;YACN,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,GAAG,CAAC;QACzB,GAAG,IAAI,CAAC,CAAC;QAET,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,EAAE,KAAK,KAAK;oBAAE,KAAK,GAAG,EAAE,CAAC;YAC/B,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpC,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,mBAAmB,EAAE,CAAC;YACxB,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,mBAAmB,GAAG,CAAC,EAAE,CAAC;gBACjD,mBAAmB,EAAE,CAAC;YACxB,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,mBAAmB,KAAK,CAAC,EAAE,CAAC;gBACnD,GAAG,EAAE,CAAC;gBACN,MAAM;YACR,CAAC;YACD,GAAG,EAAE,CAAC;QACR,CAAC;QAED,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,8FAA8F;AAC9F,qGAAqG;AACrG,iDAAiD;AACjD,SAAS,4BAA4B,CAAC,OAAe,EAAE,GAA2B;IAChF,MAAM,WAAW,GAAG,sDAAsD,CAAC;IAC3E,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,8 @@
 {
   "name": "@flighthq/xml",
-  "version": "0.3.0-next.906.07cea63",
+  "version": "0.3.0",
+  "author": "Joshua Granick and other contributors",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/flighthq/flight.git",
@@ -36,7 +38,7 @@
     "clean:dist": "tsx ../../scripts/clean-package-dist.ts"
   },
   "dependencies": {
-    "@flighthq/types": "0.3.0-next.906.07cea63"
+    "@flighthq/types": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^5.3.0"

package/src/xmlParse.test.ts

@@ -39,6 +39,11 @@ describe('parseXmlAttributes', () => {
     expect(attrs['name']).toBe('A');
   });
 
+  it('preserves out-of-range numeric references without throwing', () => {
+    const attrs = parseXmlAttributes('decimal="�" hex="�"');
+    expect(attrs).toEqual({ decimal: '�', hex: '�' });
+  });
+
   it('returns empty object for empty string', () => {
     expect(parseXmlAttributes('')).toEqual({});
   });
@@ -145,6 +150,14 @@ describe('parseXmlDocument', () => {
     expect(doc?.text).toBe('Hello!');
   });
 
+  it('preserves markup and comment syntax inside CDATA as text', () => {
+    const doc = parseXmlDocument('<root><![CDATA[<tag>&amp;<!-- literal -->]]><child/>tail</root>');
+
+    expect(doc?.children.map((child) => child.name)).toEqual(['child']);
+    expect(doc?.content[0]).toBe('<tag>&amp;<!-- literal -->');
+    expect(doc?.text).toBe('<tag>&amp;<!-- literal -->tail');
+  });
+
   it('keeps a > inside a quoted attribute value as data, not tag-end', () => {
     const root = parseXmlDocument('<node attr="a>b"/>');
     expect(root?.name).toBe('node');
@@ -167,4 +180,104 @@ describe('parseXmlDocument', () => {
     expect(doc?.name).toBe('plist');
     expect(doc?.attributes.version).toBe('1.0');
   });
+
+  it('strips an internal subset when an entity value contains ] and >', () => {
+    const xml = '<!DOCTYPE root [<!ENTITY tricky "a ] > b"><!ELEMENT root (#PCDATA)>]>' + '<root value="ok"/>';
+    const doc = parseXmlDocument(xml);
+    expect(doc?.name).toBe('root');
+    expect(doc?.attributes.value).toBe('ok');
+  });
+
+  it('strips a DOCTYPE when its external identifier contains >', () => {
+    const xml = '<!DOCTYPE root SYSTEM "https://example.invalid/a>b.dtd"><root/>';
+    const doc = parseXmlDocument(xml);
+    expect(doc?.name).toBe('root');
+  });
+});
+
+// A general entity's replacement text is markup, so it has to be substituted into the source before
+// the tree is built. Declarations live in a DOCTYPE's internal subset, which is otherwise discarded.
+describe('parseXmlDocument internal DTD entities', () => {
+  const doctype = (subset: string, body: string): string =>
+    `<?xml version="1.0"?><!DOCTYPE root [${subset}]><root>${body}</root>`;
+
+  it('expands an entity whose replacement is an element', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY dot "<circle r=\'4\'/>">', '&dot;'))!;
+
+    expect(root.children).toHaveLength(1);
+    expect(root.children[0].name).toBe('circle');
+    expect(root.children[0].attributes.r).toBe('4');
+  });
+
+  it('expands the same entity at every reference', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY dot "<circle/>">', '&dot;&dot;&dot;'))!;
+
+    expect(root.children).toHaveLength(3);
+  });
+
+  it('expands an entity declared with single quotes', () => {
+    const root = parseXmlDocument(doctype("<!ENTITY dot '<circle/>'", '&dot;').replace(']', '>]'))!;
+
+    expect(root.children[0].name).toBe('circle');
+  });
+
+  it('expands an entity that references another entity', () => {
+    const subset = '<!ENTITY inner "<circle/>"><!ENTITY outer "<g>&inner;</g>">';
+    const root = parseXmlDocument(doctype(subset, '&outer;'))!;
+
+    expect(root.children[0].name).toBe('g');
+    expect(root.children[0].children[0].name).toBe('circle');
+  });
+
+  it('expands an entity used as an attribute value', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY w "40">', '<rect width="&w;"/>'))!;
+
+    expect(root.children[0].attributes.width).toBe('40');
+  });
+
+  it('leaves an undeclared reference alone rather than dropping it', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY dot "<circle/>">', '&missing;'))!;
+
+    expect(root.text).toBe('&missing;');
+  });
+
+  it('still decodes the predefined entities, which no subset needs to declare', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY dot "<circle/>">', 'a &amp; b'))!;
+
+    expect(root.text).toBe('a & b');
+  });
+
+  // An external entity resolves a URL or file path at parse time — a document reading whatever the
+  // process can reach. Not honoring one is the point, not a gap.
+  it.each([
+    { form: 'external SYSTEM', subset: '<!ENTITY x SYSTEM "/etc/passwd">' },
+    { form: 'external PUBLIC', subset: '<!ENTITY x PUBLIC "-//X//EN" "http://example.test/x">' },
+    { form: 'parameter', subset: '<!ENTITY % x "<circle/>">' },
+  ])('does not honor an $form entity', ({ subset }) => {
+    const root = parseXmlDocument(doctype(subset, '&x;'))!;
+
+    expect(root.children).toHaveLength(0);
+    expect(root.text).toBe('&x;');
+  });
+
+  // Entities that reference each other expand exponentially. The budget is what keeps a hostile
+  // document costing bounded work; it stops expanding and keeps what resolved.
+  it('does not expand a nested entity without bound', () => {
+    // Six levels, each ten references deep: fully expanded this is ten million characters, so an
+    // unbudgeted parser materializes it and a budgeted one stops well short.
+    let subset = '<!ENTITY e0 "aaaaaaaaaa">';
+    for (let level = 1; level <= 6; level++) {
+      subset += `<!ENTITY e${level} "${`&e${level - 1};`.repeat(10)}">`;
+    }
+
+    const root = parseXmlDocument(doctype(subset, '&e6;'))!;
+
+    expect(root.text.length).toBeLessThan(200000);
+  });
+
+  it('terminates on an entity that references itself', () => {
+    const root = parseXmlDocument(doctype('<!ENTITY loop "&loop;">', '&loop;'))!;
+
+    expect(root).not.toBeNull();
+  });
 });