@manuscripts/transform 4.3.20 → 4.3.21

package/dist/cjs/jats/__tests__/jats-exporter.test.js

@@ -21,6 +21,7 @@ const parse_jats_article_1 = require("../importer/parse-jats-article");
 const citations_1 = require("./citations");
 const section_categories_1 = require("./data/section-categories");
 const files_1 = require("./files");
+const schema_1 = require("../../schema");
 const parseXMLWithDTD = (data) => (0, libxmljs2_1.parseXml)(data, {
     dtdload: true,
     dtdvalid: true,
@@ -37,6 +38,23 @@ describe('JATS exporter', () => {
         });
         expect(result).toMatchSnapshot('jats-export');
     });
+    test('export with & and < in bibliography metadata', async () => {
+        const transformer = new jats_exporter_1.JATSExporter();
+        const input = await (0, files_1.readAndParseFixture)('jats-example-full.xml');
+        const { node, journal } = (0, parse_jats_article_1.parseJATSArticle)(input, section_categories_1.sectionCategories);
+        let biblio = null;
+        node.descendants((n) => {
+            if ((0, schema_1.isBibliographyItemNode)(n)) {
+                biblio = n;
+            }
+        });
+        biblio.attrs.title += ' & Sons 55 < 135';
+        const result = await transformer.serializeToJATS(node, {
+            csl: citations_1.DEFAULT_CSL_OPTIONS,
+            journal,
+        });
+        expect(result).toMatchSnapshot('jats-export-with-xml-unsafe-in-biblios');
+    });
     test('export v1.1', async () => {
         const transformer = new jats_exporter_1.JATSExporter();
         const input = await (0, files_1.readAndParseFixture)('jats-example-full.xml');

package/dist/cjs/jats/exporter/jats-exporter.js

@@ -457,7 +457,7 @@ class JATSExporter {
             const parser = new DOMParser();
             const [_, bibliography] = this.engine.makeBibliography();
             for (let i = 0; i < bibliography.length; i++) {
-                const item = `<template xmlns:xlink="${xml_1.XLINK_NAMESPACE}">${bibliography[i]}</template>`;
+                const item = `<template xmlns:xlink="${xml_1.XLINK_NAMESPACE}">${(0, xml_1.sanitizeXmlString)(bibliography[i])}</template>`;
                 const ref = parser.parseFromString(item, 'text/xml').querySelector('ref');
                 if (ref) {
                     refList.appendChild(ref);

package/dist/cjs/lib/xml.js

@@ -16,5 +16,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.XML_NAMESPACE = exports.XLINK_NAMESPACE = void 0;
+exports.sanitizeXmlString = sanitizeXmlString;
 exports.XLINK_NAMESPACE = 'http://www.w3.org/1999/xlink';
 exports.XML_NAMESPACE = 'http://www.w3.org/XML/1998/namespace';
+function sanitizeXmlString(str) {
+    return (str
+        .replace(/&(?!(?:amp|lt|gt|quot|apos|#[0-9]+|#x[0-9a-fA-F]+);)/g, '&')
+        .replace(/<(?![a-zA-Z_\/!?])/g, '&lt;'));
+}

package/dist/cjs/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
-exports.VERSION = "4.3.20";
+exports.VERSION = "4.3.21";

package/dist/es/jats/__tests__/jats-exporter.test.js

@@ -19,6 +19,7 @@ import { parseJATSArticle } from '../importer/parse-jats-article';
 import { DEFAULT_CSL_OPTIONS } from './citations';
 import { sectionCategories } from './data/section-categories';
 import { readAndParseFixture } from './files';
+import { isBibliographyItemNode } from '../../schema';
 const parseXMLWithDTD = (data) => parseXml(data, {
     dtdload: true,
     dtdvalid: true,
@@ -35,6 +36,23 @@ describe('JATS exporter', () => {
         });
         expect(result).toMatchSnapshot('jats-export');
     });
+    test('export with & and < in bibliography metadata', async () => {
+        const transformer = new JATSExporter();
+        const input = await readAndParseFixture('jats-example-full.xml');
+        const { node, journal } = parseJATSArticle(input, sectionCategories);
+        let biblio = null;
+        node.descendants((n) => {
+            if (isBibliographyItemNode(n)) {
+                biblio = n;
+            }
+        });
+        biblio.attrs.title += ' & Sons 55 < 135';
+        const result = await transformer.serializeToJATS(node, {
+            csl: DEFAULT_CSL_OPTIONS,
+            journal,
+        });
+        expect(result).toMatchSnapshot('jats-export-with-xml-unsafe-in-biblios');
+    });
     test('export v1.1', async () => {
         const transformer = new JATSExporter();
         const input = await readAndParseFixture('jats-example-full.xml');

package/dist/es/jats/exporter/jats-exporter.js

@@ -21,7 +21,7 @@ import { buildCiteprocCitation } from '../../lib/citeproc';
 import { CreditRoleUrls } from '../../lib/credit-roles';
 import { generateFootnoteLabels } from '../../lib/footnotes';
 import { nodeFromHTML } from '../../lib/html';
-import { XLINK_NAMESPACE, XML_NAMESPACE } from '../../lib/xml';
+import { sanitizeXmlString, XLINK_NAMESPACE, XML_NAMESPACE, } from '../../lib/xml';
 import { isBibliographyItemNode, isCitationNode, isNodeOfType, schema, } from '../../schema';
 import { isExecutableNodeType, isNodeType } from '../../transformer';
 import { initJats, jatsVariableWrapper } from './citeproc';
@@ -417,7 +417,7 @@ export class JATSExporter {
             const parser = new DOMParser();
             const [_, bibliography] = this.engine.makeBibliography();
             for (let i = 0; i < bibliography.length; i++) {
-                const item = `<template xmlns:xlink="${XLINK_NAMESPACE}">${bibliography[i]}</template>`;
+                const item = `<template xmlns:xlink="${XLINK_NAMESPACE}">${sanitizeXmlString(bibliography[i])}</template>`;
                 const ref = parser.parseFromString(item, 'text/xml').querySelector('ref');
                 if (ref) {
                     refList.appendChild(ref);

package/dist/es/lib/xml.js

@@ -15,3 +15,8 @@
  */
 export const XLINK_NAMESPACE = 'http://www.w3.org/1999/xlink';
 export const XML_NAMESPACE = 'http://www.w3.org/XML/1998/namespace';
+export function sanitizeXmlString(str) {
+    return (str
+        .replace(/&(?!(?:amp|lt|gt|quot|apos|#[0-9]+|#x[0-9a-fA-F]+);)/g, '&')
+        .replace(/<(?![a-zA-Z_\/!?])/g, '&lt;'));
+}

package/dist/es/version.js

@@ -1 +1 @@
-export const VERSION = "4.3.20";
+export const VERSION = "4.3.21";

package/dist/types/lib/xml.d.ts

@@ -15,3 +15,4 @@
  */
 export declare const XLINK_NAMESPACE = "http://www.w3.org/1999/xlink";
 export declare const XML_NAMESPACE = "http://www.w3.org/XML/1998/namespace";
+export declare function sanitizeXmlString(str: string): string;

package/dist/types/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "4.3.20";
+export declare const VERSION = "4.3.21";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@manuscripts/transform",
   "description": "ProseMirror transformer for Manuscripts applications",
-  "version": "4.3.20",
+  "version": "4.3.21",
   "repository": "github:Atypon-OpenSource/manuscripts-transform",
   "license": "Apache-2.0",
   "main": "dist/cjs",