@longsightgroup/qti3-core 0.7.2 → 0.8.0

package/dist/xml.js

@@ -1,191 +1,112 @@
-import { StaxXmlParserSync, XmlEventType } from "stax-xml";
+/**
+ * Minimal XML parser for QTI item/package XML.
+ *
+ * The parser intentionally does not process DTD entity declarations, resolve external entities,
+ * read from the network/filesystem, or expand custom entities. That keeps QTI parsing structurally
+ * immune to XXE and billion-laughs style expansion: numeric references decode to at most one code
+ * point, predefined entities decode once, and every other entity reference remains verbatim.
+ */
 export function parseXmlTree(xml) {
-    const parser = new StaxXmlParserSync(xml, {
-        autoDecodeEntities: true,
-    });
-    const tagTokens = scanXmlTagTokens(xml);
-    const stack = [];
-    const errors = [];
-    let root;
-    let tagTokenIndex = 0;
-    try {
-        for (const event of parser) {
-            if (event.type === XmlEventType.ERROR) {
-                errors.push(event.error);
-                continue;
-            }
-            if (event.type === XmlEventType.START_ELEMENT) {
-                const parent = stack.at(-1);
-                const path = nodePath(parent, event.localName ?? event.name);
-                const sourceRange = { startOffset: -1, startTagEndOffset: -1 };
-                const token = tagTokens[tagTokenIndex];
-                if (token?.kind === "start" && token.name === event.name) {
-                    tagTokenIndex += 1;
-                    sourceRange.startOffset = token.startOffset;
-                    sourceRange.startTagEndOffset = token.startTagEndOffset;
-                    if (token.endOffset !== undefined) {
-                        sourceRange.endOffset = token.endOffset;
-                    }
-                }
-                else {
-                    errors.push(new Error(`XML source range alignment failed for <${event.name}>.`));
-                }
-                const node = {
-                    name: event.name,
-                    localName: event.localName ?? event.name,
-                    prefix: event.prefix,
-                    uri: event.uri,
-                    attributes: event.attributes,
-                    children: [],
-                    content: [],
-                    text: "",
-                    source: sourceLocation(xml, sourceRange.startOffset, path),
-                    sourceRange,
-                };
-                if (parent) {
-                    node.parent = parent;
-                    parent.children.push(node);
-                    parent.content.push(node);
-                }
-                else {
-                    root = node;
-                }
-                stack.push(node);
-                continue;
+    if (xml.charCodeAt(0) === 0xfeff)
+        xml = xml.slice(1);
+    const state = {
+        xml,
+        lineStarts: buildLineStarts(xml),
+        errors: [],
+        root: undefined,
+        stack: [],
+        namespaceStack: [],
+    };
+    let offset = 0;
+    while (offset < xml.length) {
+        const markupOffset = xml.indexOf("<", offset);
+        if (markupOffset < 0) {
+            appendText(xml.slice(offset), state);
+            break;
+        }
+        if (markupOffset > offset) {
+            appendText(xml.slice(offset, markupOffset), state);
+        }
+        if (markupOffset + 1 >= xml.length) {
+            state.errors.push(new Error("Malformed XML tag at end of document."));
+            break;
+        }
+        if (xml.startsWith("<!--", markupOffset)) {
+            const endOffset = xml.indexOf("-->", markupOffset + 4);
+            if (endOffset < 0) {
+                state.errors.push(new Error("Unterminated XML comment."));
+                break;
             }
-            if (event.type === XmlEventType.END_ELEMENT) {
-                const node = stack.pop();
-                if (node) {
-                    if (node.sourceRange.endOffset === undefined) {
-                        const token = tagTokens[tagTokenIndex];
-                        if (token?.kind === "end" && token.name === event.name) {
-                            tagTokenIndex += 1;
-                            node.sourceRange.endOffset = token.endOffset;
-                            node.endSource = sourceLocation(xml, token.startOffset, node.source.path);
-                        }
-                        else {
-                            errors.push(new Error(`XML source range alignment failed for </${event.name}>.`));
-                        }
-                    }
-                }
-                continue;
+            offset = endOffset + 3;
+            continue;
+        }
+        if (xml.startsWith("<![CDATA[", markupOffset)) {
+            const endOffset = xml.indexOf("]]>", markupOffset + 9);
+            if (endOffset < 0) {
+                state.errors.push(new Error("Unterminated CDATA section."));
+                break;
             }
-            if (event.type === XmlEventType.CHARACTERS || event.type === XmlEventType.CDATA) {
-                const node = stack.at(-1);
-                if (node) {
-                    node.text += event.value;
-                    node.content.push(event.value);
-                }
+            appendCharacterData(xml.slice(markupOffset + 9, endOffset), state);
+            offset = endOffset + 3;
+            continue;
+        }
+        const next = xml.charAt(markupOffset + 1);
+        if (next === "?") {
+            const endOffset = xml.indexOf("?>", markupOffset + 2);
+            if (endOffset < 0) {
+                state.errors.push(new Error("Unterminated XML processing instruction."));
+                break;
             }
+            offset = endOffset + 2;
+            continue;
         }
-    }
-    catch (error) {
-        errors.push(error instanceof Error ? error : new Error(String(error)));
-    }
-    for (const node of [...stack].reverse()) {
-        errors.push(new Error(`Unexpected end of document. Missing closing tag for <${node.name}>.`));
-    }
-    if (root)
-        restoreMixedContentFromSource(xml, root);
-    return { root, errors };
-}
-/**
- * stax-xml trims boundary whitespace around child elements. Re-slice mixed content from the
- * original XML so authored spacing around inline markup (for example `<em>`) is preserved.
- */
-const inlineMixedContentChildNames = new Set([
-    "a",
-    "abbr",
-    "b",
-    "bdi",
-    "bdo",
-    "cite",
-    "code",
-    "dfn",
-    "em",
-    "i",
-    "kbd",
-    "mark",
-    "q",
-    "rp",
-    "rt",
-    "ruby",
-    "s",
-    "samp",
-    "small",
-    "span",
-    "strong",
-    "sub",
-    "sup",
-    "var",
-    "qti-feedback-inline",
-    "qti-gap",
-    "qti-hottext",
-    "qti-inline-choice-interaction",
-    "qti-printed-variable",
-    "qti-template-inline",
-    "qti-text-entry-interaction",
-]);
-function shouldRestoreMixedContentWhitespace(node) {
-    return node.content.some((entry) => typeof entry !== "string" && inlineMixedContentChildNames.has(entry.localName));
-}
-function restoreMixedContentFromSource(xml, node) {
-    for (const entry of node.content) {
-        if (typeof entry !== "string")
-            restoreMixedContentFromSource(xml, entry);
-    }
-    if (!shouldRestoreMixedContentWhitespace(node))
-        return;
-    const contentEndOffset = node.endSource?.offset ?? node.sourceRange.endOffset;
-    if (node.sourceRange.startTagEndOffset < 0 || contentEndOffset === undefined)
-        return;
-    const restored = [];
-    let cursor = node.sourceRange.startTagEndOffset + 1;
-    for (const entry of node.content) {
-        if (typeof entry === "string")
+        if (next === "!") {
+            const endOffset = findMarkupDeclarationEndOffset(xml, markupOffset + 2);
+            if (endOffset < 0) {
+                state.errors.push(new Error("Unterminated XML markup declaration."));
+                break;
+            }
+            offset = endOffset + 1;
             continue;
-        const childStart = entry.sourceRange.startOffset;
-        if (childStart < 0)
+        }
+        if (next === "/") {
+            const endOffset = findTagEndOffset(xml, markupOffset + 2);
+            if (endOffset < 0) {
+                state.errors.push(new Error("Unterminated XML closing tag."));
+                break;
+            }
+            const name = readTagName(xml, markupOffset + 2, endOffset);
+            if (!name) {
+                state.errors.push(new Error("Malformed XML closing tag."));
+            }
+            else {
+                closeElement(name, markupOffset, endOffset, state);
+            }
+            offset = endOffset + 1;
             continue;
-        if (childStart > cursor) {
-            appendDecodedTextSegment(restored, xml.slice(cursor, childStart));
         }
-        restored.push(entry);
-        const childEnd = entry.sourceRange.endOffset;
-        if (childEnd === undefined || childEnd < cursor)
+        const endOffset = findTagEndOffset(xml, markupOffset + 1);
+        if (endOffset < 0) {
+            state.errors.push(new Error("Unterminated XML start tag."));
+            break;
+        }
+        const name = readTagName(xml, markupOffset + 1, endOffset);
+        if (!name) {
+            state.errors.push(new Error("Malformed XML start tag."));
+            offset = endOffset + 1;
             continue;
-        cursor = childEnd;
+        }
+        const selfClosing = isSelfClosingStartTag(xml, endOffset);
+        const attributes = parseAttributes(xml, markupOffset + 1 + name.length, selfClosing ? trailingSlashOffset(xml, endOffset) : endOffset, state);
+        openElement(name, attributes, markupOffset, endOffset, selfClosing, state);
+        offset = endOffset + 1;
     }
-    if (contentEndOffset > cursor) {
-        appendDecodedTextSegment(restored, xml.slice(cursor, contentEndOffset));
+    for (const node of [...state.stack].reverse()) {
+        state.errors.push(new Error(`Unexpected end of document. Missing closing tag for <${node.name}>.`));
     }
-    node.content = restored;
-    node.text = restored.filter((entry) => typeof entry === "string").join("");
-}
-function appendDecodedTextSegment(content, raw) {
-    const decoded = decodeXmlCharacterData(raw);
-    if (decoded.length > 0)
-        content.push(decoded);
-}
-const predefinedXmlEntities = {
-    amp: "&",
-    apos: "'",
-    gt: ">",
-    lt: "<",
-    quot: '"',
-};
-function decodeXmlCharacterData(value) {
-    return value.replace(/&(#x?[0-9a-fA-F]+|[A-Za-z]+);/g, (entity, body) => {
-        if (body.startsWith("#x") || body.startsWith("#X")) {
-            const codePoint = Number.parseInt(body.slice(2), 16);
-            return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : entity;
-        }
-        if (body.startsWith("#")) {
-            const codePoint = Number.parseInt(body.slice(1), 10);
-            return Number.isFinite(codePoint) ? String.fromCodePoint(codePoint) : entity;
-        }
-        return predefinedXmlEntities[body] ?? entity;
-    });
+    if (!state.root)
+        state.errors.push(new Error("XML document does not contain a root element."));
+    return { root: state.root, errors: state.errors };
 }
 export function childElements(node, localName) {
     return node.children.filter((child) => !localName || child.localName === localName);
@@ -203,71 +124,192 @@ export function textContent(node) {
     const parts = node.content.map((entry) => typeof entry === "string" ? entry : textContent(entry));
     return parts.join(" ").replace(/\s+/g, " ").trim();
 }
-function scanXmlTagTokens(xml) {
-    const tokens = [];
-    let offset = 0;
-    while (offset < xml.length) {
-        const startOffset = xml.indexOf("<", offset);
-        if (startOffset === -1 || startOffset + 1 >= xml.length)
-            return tokens;
-        if (xml.startsWith("<!--", startOffset)) {
-            offset = skipPastSequence(xml, "-->", startOffset + 4);
-            continue;
+function openElement(name, parsedAttributes, startOffset, startTagEndOffset, selfClosing, state) {
+    const parent = state.stack.at(-1);
+    if (!parent && state.root) {
+        state.errors.push(new Error(`XML document contains multiple root elements; found <${name}>.`));
+    }
+    const attributes = {};
+    const inheritedNamespaces = state.namespaceStack.at(-1)?.namespaces ?? {};
+    const namespaces = { ...inheritedNamespaces };
+    for (const attribute of parsedAttributes) {
+        attributes[attribute.name] = attribute.value;
+        if (attribute.name === "xmlns")
+            namespaces[""] = attribute.value;
+        else if (attribute.name.startsWith("xmlns:"))
+            namespaces[attribute.name.slice(6)] = attribute.value;
+    }
+    const { prefix, localName } = splitQualifiedName(name);
+    const path = nodePath(parent, localName);
+    const sourceRange = {
+        startOffset,
+        startTagEndOffset,
+        endOffset: selfClosing ? startTagEndOffset + 1 : undefined,
+    };
+    const node = {
+        name,
+        localName,
+        prefix,
+        uri: namespaces[prefix ?? ""],
+        attributes,
+        children: [],
+        content: [],
+        text: "",
+        source: sourceLocation(state, startOffset, path),
+        sourceRange,
+    };
+    if (parent) {
+        node.parent = parent;
+        parent.children.push(node);
+        parent.content.push(node);
+    }
+    else if (!state.root) {
+        state.root = node;
+    }
+    if (!selfClosing) {
+        state.stack.push(node);
+        state.namespaceStack.push({ namespaces });
+    }
+}
+function closeElement(name, startOffset, tagEndOffset, state) {
+    const top = state.stack.at(-1);
+    if (!top) {
+        state.errors.push(new Error(`Unexpected closing tag </${name}>.`));
+        return;
+    }
+    let matchIndex = -1;
+    for (let index = state.stack.length - 1; index >= 0; index -= 1) {
+        if (state.stack[index]?.name === name) {
+            matchIndex = index;
+            break;
         }
-        if (xml.startsWith("<![CDATA[", startOffset)) {
-            offset = skipPastSequence(xml, "]]>", startOffset + 9);
-            continue;
+    }
+    if (matchIndex < 0) {
+        state.errors.push(new Error(`Unexpected closing tag </${name}>; expected </${top.name}>.`));
+        return;
+    }
+    if (matchIndex !== state.stack.length - 1) {
+        state.errors.push(new Error(`Mismatched closing tag </${name}>; expected </${top.name}>.`));
+        while (state.stack.length - 1 > matchIndex) {
+            const unclosed = state.stack.pop();
+            state.namespaceStack.pop();
+            if (unclosed) {
+                state.errors.push(new Error(`Implicitly closed <${unclosed.name}> due to mismatched tag </${name}>.`));
+            }
         }
-        const next = xml.charAt(startOffset + 1);
-        if (next === "?") {
-            offset = skipPastSequence(xml, "?>", startOffset + 2);
+    }
+    const node = state.stack.pop();
+    state.namespaceStack.pop();
+    if (!node)
+        return;
+    node.sourceRange.endOffset = tagEndOffset + 1;
+    node.endSource = sourceLocation(state, startOffset, node.source.path);
+}
+function appendText(raw, state) {
+    appendCharacterData(decodeXmlCharacterData(raw, state), state);
+}
+function appendCharacterData(text, state) {
+    if (text.length === 0)
+        return;
+    const parent = state.stack.at(-1);
+    if (parent) {
+        parent.text += text;
+        parent.content.push(text);
+        return;
+    }
+    if (text.trim().length === 0)
+        return;
+    if (state.root)
+        state.errors.push(new Error("XML document contains content after the root element."));
+    else
+        state.errors.push(new Error("XML document contains content before the root element."));
+}
+function parseAttributes(xml, from, to, state) {
+    const attributes = [];
+    let offset = from;
+    while (offset < to) {
+        while (offset < to && /\s/.test(xml.charAt(offset)))
+            offset += 1;
+        if (offset >= to)
+            break;
+        const nameStart = offset;
+        while (offset < to) {
+            const char = xml.charAt(offset);
+            if (/\s/.test(char) || char === "=" || char === "/" || char === ">")
+                break;
+            offset += 1;
+        }
+        const name = xml.slice(nameStart, offset);
+        if (!name) {
+            state.errors.push(new Error("Malformed XML attribute."));
+            offset += 1;
             continue;
         }
-        if (next === "!") {
-            const declarationEndOffset = findMarkupDeclarationEndOffset(xml, startOffset + 2);
-            offset = declarationEndOffset >= 0 ? declarationEndOffset + 1 : xml.length;
+        while (offset < to && /\s/.test(xml.charAt(offset)))
+            offset += 1;
+        if (xml.charAt(offset) !== "=") {
+            state.errors.push(new Error(`Malformed XML attribute ${name}; expected =.`));
+            while (offset < to && !/\s/.test(xml.charAt(offset)))
+                offset += 1;
             continue;
         }
-        if (next === "/") {
-            const tagEndOffset = findTagEndOffset(xml, startOffset + 2);
-            if (tagEndOffset < 0)
-                return tokens;
-            const name = readTagName(xml, startOffset + 2, tagEndOffset);
-            if (name) {
-                tokens.push({
-                    kind: "end",
-                    name,
-                    startOffset,
-                    startTagEndOffset: tagEndOffset,
-                    endOffset: tagEndOffset + 1,
-                    selfClosing: false,
-                });
-            }
-            offset = tagEndOffset + 1;
+        offset += 1;
+        while (offset < to && /\s/.test(xml.charAt(offset)))
+            offset += 1;
+        const quote = xml.charAt(offset);
+        if (quote !== '"' && quote !== "'") {
+            state.errors.push(new Error(`Malformed XML attribute ${name}; expected quoted value.`));
+            while (offset < to && !/\s/.test(xml.charAt(offset)))
+                offset += 1;
             continue;
         }
-        const tagEndOffset = findTagEndOffset(xml, startOffset + 1);
-        if (tagEndOffset < 0)
-            return tokens;
-        const name = readTagName(xml, startOffset + 1, tagEndOffset);
-        if (name) {
-            const selfClosing = isSelfClosingStartTag(xml, tagEndOffset);
-            tokens.push({
-                kind: "start",
-                name,
-                startOffset,
-                startTagEndOffset: tagEndOffset,
-                endOffset: selfClosing ? tagEndOffset + 1 : undefined,
-                selfClosing,
-            });
+        offset += 1;
+        const valueStart = offset;
+        const valueEnd = xml.indexOf(quote, valueStart);
+        if (valueEnd < 0 || valueEnd > to) {
+            state.errors.push(new Error(`Unterminated XML attribute ${name}.`));
+            break;
         }
-        offset = tagEndOffset + 1;
+        attributes.push({
+            name,
+            value: decodeXmlCharacterData(xml.slice(valueStart, valueEnd), state),
+        });
+        offset = valueEnd + 1;
     }
-    return tokens;
+    return attributes;
 }
-function skipPastSequence(xml, sequence, from) {
-    const endOffset = xml.indexOf(sequence, from);
-    return endOffset >= 0 ? endOffset + sequence.length : xml.length;
+const predefinedXmlEntities = {
+    amp: "&",
+    apos: "'",
+    gt: ">",
+    lt: "<",
+    quot: '"',
+};
+function decodeXmlCharacterData(value, state) {
+    return value.replace(/&(#x[0-9a-fA-F]+|#X[0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9._:-]*);/g, (entity, body) => {
+        if (body.startsWith("#x") || body.startsWith("#X")) {
+            return decodeNumericEntity(entity, Number.parseInt(body.slice(2), 16), state);
+        }
+        if (body.startsWith("#")) {
+            return decodeNumericEntity(entity, Number.parseInt(body.slice(1), 10), state);
+        }
+        return predefinedXmlEntities[body] ?? entity;
+    });
+}
+function decodeNumericEntity(entity, codePoint, state) {
+    if (!Number.isFinite(codePoint) || !isXmlChar(codePoint)) {
+        state.errors.push(new Error(`Invalid XML character reference ${entity}.`));
+        return entity;
+    }
+    return String.fromCodePoint(codePoint);
+}
+function isXmlChar(codePoint) {
+    return (codePoint === 0x9 ||
+        codePoint === 0xa ||
+        codePoint === 0xd ||
+        (codePoint >= 0x20 && codePoint <= 0xd7ff) ||
+        (codePoint >= 0xe000 && codePoint <= 0xfffd) ||
+        (codePoint >= 0x10000 && codePoint <= 0x10ffff));
 }
 function findMarkupDeclarationEndOffset(xml, from) {
     let quote = null;
@@ -328,29 +370,53 @@ function findTagEndOffset(xml, from) {
     return -1;
 }
 function isSelfClosingStartTag(xml, tagEndOffset) {
+    return xml.charAt(trailingSlashOffset(xml, tagEndOffset)) === "/";
+}
+function trailingSlashOffset(xml, tagEndOffset) {
     for (let index = tagEndOffset - 1; index >= 0; index -= 1) {
-        const char = xml.charAt(index);
-        if (/\s/.test(char))
+        if (/\s/.test(xml.charAt(index)))
             continue;
-        return char === "/";
+        return index;
     }
-    return false;
+    return tagEndOffset;
 }
-function sourceLocation(xml, offset, path) {
-    if (offset < 0)
-        return { line: 1, column: 1, offset: 0, path };
-    let line = 1;
-    let column = 1;
-    for (let index = 0; index < offset; index += 1) {
-        if (xml.charAt(index) === "\n") {
-            line += 1;
-            column = 1;
-        }
-        else {
-            column += 1;
-        }
+function splitQualifiedName(name) {
+    const separator = name.indexOf(":");
+    if (separator < 0)
+        return { prefix: undefined, localName: name };
+    return {
+        prefix: name.slice(0, separator),
+        localName: name.slice(separator + 1),
+    };
+}
+function buildLineStarts(xml) {
+    const lineStarts = [0];
+    for (let index = 0; index < xml.length; index += 1) {
+        if (xml.charAt(index) === "\n")
+            lineStarts.push(index + 1);
+    }
+    return lineStarts;
+}
+function sourceLocation(state, offset, path) {
+    const normalizedOffset = Math.max(0, offset);
+    let low = 0;
+    let high = state.lineStarts.length - 1;
+    while (low <= high) {
+        const middle = Math.floor((low + high) / 2);
+        const lineStart = state.lineStarts[middle] ?? 0;
+        if (lineStart <= normalizedOffset)
+            low = middle + 1;
+        else
+            high = middle - 1;
     }
-    return { line, column, offset, path };
+    const lineIndex = Math.max(0, high);
+    const lineStart = state.lineStarts[lineIndex] ?? 0;
+    return {
+        line: lineIndex + 1,
+        column: normalizedOffset - lineStart + 1,
+        offset: normalizedOffset,
+        path,
+    };
 }
 function nodePath(parent, localName) {
     if (!parent)
@@ -358,4 +424,10 @@ function nodePath(parent, localName) {
     const index = parent.children.filter((child) => child.localName === localName).length + 1;
     return `${parent.source.path}/${localName}[${index}]`;
 }
+export function escapeXmlText(value) {
+    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+export function escapeXmlAttribute(value) {
+    return escapeXmlText(value).replaceAll('"', "&quot;");
+}
 //# sourceMappingURL=xml.js.map