@xmldom/xmldom 0.8.12 → 0.8.13

package/CHANGELOG.md

@@ -4,16 +4,39 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.13](https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13)
+
+### Fixed
+
+- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`, `NodeList.toString()`) now accept a `requireWellFormed` option (fourth argument, after `isHtml` and `nodeFilter`). When `{ requireWellFormed: true }` is passed, the serializer throws `InvalidStateError` for injection-prone node content, preventing XML injection via attacker-controlled node data. [`GHSA-j759-j44w-7fr8`](https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8) [`GHSA-x6wf-f3px-wcqx`](https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx) [`GHSA-f6ww-3ggp-fr8h`](https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
+  - Comment: throws when `data` contains `-->`
+  - ProcessingInstruction: throws when `data` contains `?>`
+  - DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId` fails `SystemLiteral`, or `internalSubset` contains `]>`
+- Security: DOM traversal operations (`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`, `Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node, true)`, `node.textContent` getter, `getElementsByTagName()` / `getElementsByTagNameNS()` / `getElementsByClassName()` / `getElementById()`) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable `RangeError`. [`GHSA-2v35-w6hq-6mfw`](https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)
+
+Thank you,
+[@Jvr2022](https://github.com/Jvr2022),
+[@praveen-kv](https://github.com/praveen-kv),
+[@TharVid](https://github.com/TharVid),
+[@decsecre583](https://github.com/decsecre583),
+[@tlsbollei](https://github.com/tlsbollei),
+[@KarimTantawey](https://github.com/KarimTantawey),
+for your contributions
+
 ## [0.8.12](https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12)
 
 ### Fixed
 
+- preserve trailing whitespace in ProcessingInstruction data [`#962`](https://github.com/xmldom/xmldom/pull/962) / [`#42`](https://github.com/xmldom/xmldom/issues/42)
 - Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
 - Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
 
 Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.
 
-Thank you, [@thesmartshadow](https://github.com/thesmartshadow), for your contributions
+Thank you,
+[@thesmartshadow](https://github.com/thesmartshadow),
+[@stevenobiajulu](https://github.com/stevenobiajulu),
+for your contributions
 
 ## [0.8.11](https://github.com/xmldom/xmldom/compare/0.8.10...0.8.11)
 

package/index.d.ts

@@ -22,18 +22,52 @@ declare module "@xmldom/xmldom" {
       parseFromString(xmlsource: string, mimeType?: string): Document;
   }
 
+  /** Options accepted by `XMLSerializer.prototype.serializeToString`. */
+  interface XMLSerializerOptions {
+      /**
+       * When `true`, the serializer throws a DOMException with code `INVALID_STATE_ERR` if:
+       * - A CDATASection node's data contains `"]]>"`.
+       * - A Comment node's data contains `"-->"` (the injection sequence that terminates a
+       *   comment). Comments whose data contains `"--"` but not `"-->"` are accepted on this
+       *   branch — the 0.8.x parser does not validate bare `"--"` in comment content.
+       * - A ProcessingInstruction's data contains `"?>"` (W3C DOM Parsing §3.2.1.7).
+       *
+       * @default false
+       */
+      requireWellFormed?: boolean;
+  }
+
   interface XMLSerializer {
       /**
        * Returns the result of serializing `node` to XML.
        *
+       * When `options.requireWellFormed` is `true`, the serializer throws for content that would
+       * produce ill-formed XML.
+       *
        * __This implementation differs from the specification:__
        * - CDATASection nodes whose data contains `]]>` are serialized by splitting the section
        *   at each `]]>` occurrence (following W3C DOM Level 3 Core `split-cdata-sections`
-       *   default behaviour). A configurable option is not yet implemented.
+       *   default behaviour) unless `requireWellFormed` is `true`.
+       * - when `requireWellFormed` is `true`, `DOMException` with code `INVALID_STATE_ERR`
+       *   is only thrown to prevent injection vectors, not for all the spec mandated checks.
        *
+       * @throws {DOMException}
+       * With code `INVALID_STATE_ERR` when `requireWellFormed` is `true` and:
+       * - a CDATASection node's data contains `"]]>"`,
+       * - a Comment node's data contains `"-->"` (bare `"--"` does not throw on this branch),
+       * - a ProcessingInstruction's data contains `"?>"`,
+       * - a DocumentType's `publicId` is non-empty and does not match the XML `PubidLiteral`
+       *   production,
+       * - a DocumentType's `systemId` is non-empty and does not match the XML `SystemLiteral`
+       *   production, or
+       * - a DocumentType's `internalSubset` contains `"]>"`.
+       * Note: xmldom does not enforce `readonly` on DocumentType fields — direct property
+       * writes succeed and are covered by the serializer-level checks above.
        * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
+       * @see https://w3c.github.io/DOM-Parsing/#xml-serialization
+       * @see https://github.com/w3c/DOM-Parsing/issues/84
        */
-      serializeToString(node: Node): string;
+      serializeToString(node: Node, isHtml?: boolean, nodeFilter?: (node: Node) => Node | null | undefined, options?: XMLSerializerOptions): string;
   }
 
   interface Options {

package/lib/dom.js

@@ -171,9 +171,10 @@ NodeList.prototype = {
 	item: function(index) {
 		return index >= 0 && index < this.length ? this[index] : null;
 	},
-	toString:function(isHTML,nodeFilter){
+	toString:function(isHTML,nodeFilter,options){
+		var requireWellFormed = !!options && !!options.requireWellFormed;
 		for(var buf = [], i = 0;i<this.length;i++){
-			serializeToString(this[i],buf,isHTML,nodeFilter);
+			serializeToString(this[i],buf,isHTML,nodeFilter,null,requireWellFormed);
 		}
 		return buf.join('');
 	},
@@ -419,13 +420,28 @@ DOMImplementation.prototype = {
 	/**
 	 * Returns a doctype, with the given `qualifiedName`, `publicId`, and `systemId`.
 	 *
-	 * __This behavior is slightly different from the in the specs__:
+	 * __This implementation differs from the specification:__
 	 * - this implementation is not validating names or qualified names
 	 *   (when parsing XML strings, the SAX parser takes care of that)
 	 *
+	 * Note: `internalSubset` can only be introduced via a direct property write to `node.internalSubset` after creation.
+	 * Creation-time validation of `publicId`, `systemId` is not enforced.
+	 * The serializer-level check covers all mutation vectors, including direct property writes.
+	 * `internalSubset` is only serialized as `[ ... ]` when both `publicId` and `systemId` are
+	 * absent (empty or `'.'`) — if either external identifier is present, `internalSubset` is
+	 * silently omitted from the serialized output.
+	 *
 	 * @param {string} qualifiedName
 	 * @param {string} [publicId]
+	 * The external subset public identifier. Stored verbatim including surrounding quotes.
+	 * When serialized with `requireWellFormed: true` (via the 4th-parameter options object),
+	 * throws `DOMException` with code `INVALID_STATE_ERR` if the value is non-empty and does
+	 * not match the XML `PubidLiteral` production (W3C DOM Parsing §3.2.1.3; XML 1.0 [12]).
 	 * @param {string} [systemId]
+	 * The external subset system identifier. Stored verbatim including surrounding quotes.
+	 * When serialized with `requireWellFormed: true`, throws `DOMException` with code
+	 * `INVALID_STATE_ERR` if the value is non-empty and does not match the XML `SystemLiteral`
+	 * production (W3C DOM Parsing §3.2.1.3; XML 1.0 [11]).
 	 * @returns {DocumentType} which can either be used with `DOMImplementation.createDocument` upon document creation
 	 * 				  or can be put into the document via methods like `Node.insertBefore()` or `Node.replaceChild()`
 	 *
@@ -492,18 +508,44 @@ Node.prototype = {
 		return cloneNode(this.ownerDocument||this,this,deep);
 	},
 	// Modified in DOM Level 2:
-	normalize:function(){
-		var child = this.firstChild;
-		while(child){
-			var next = child.nextSibling;
-			if(next && next.nodeType == TEXT_NODE && child.nodeType == TEXT_NODE){
-				this.removeChild(next);
-				child.appendData(next.data);
-			}else{
-				child.normalize();
-				child = next;
-			}
-		}
+	/**
+	 * Puts the specified node and all of its subtree into a "normalized" form. In a normalized
+	 * subtree, no text nodes in the subtree are empty and there are no adjacent text nodes.
+	 *
+	 * Specifically, this method merges any adjacent text nodes (i.e., nodes for which `nodeType`
+	 * is `TEXT_NODE`) into a single node with the combined data. It also removes any empty text
+	 * nodes.
+	 *
+	 * This method iteratively traverses all child nodes to normalize all descendant nodes within
+	 * the subtree.
+	 *
+	 * @throws {DOMException}
+	 * May throw a DOMException if operations within removeChild or appendData (which are
+	 * potentially invoked in this method) do not meet their specific constraints.
+	 * @see {@link Node.removeChild}
+	 * @see {@link CharacterData.appendData}
+	 * @see ../docs/walk-dom.md.
+	 */
+	normalize: function () {
+		walkDOM(this, null, {
+			enter: function (node) {
+				// Merge adjacent text children of node before walkDOM schedules them.
+				// walkDOM reads lastChild/previousSibling after enter returns, so the
+				// surviving post-merge children are what it descends into.
+				var child = node.firstChild;
+				while (child) {
+					var next = child.nextSibling;
+					if (next !== null && next.nodeType === TEXT_NODE && child.nodeType === TEXT_NODE) {
+						node.removeChild(next);
+						child.appendData(next.data);
+						// Do not advance child: re-check new nextSibling for another text run
+					} else {
+						child = next;
+					}
+				}
+				return true; // descend into surviving children
+			},
+		});
 	},
   	// Introduced in DOM Level 2:
 	isSupported:function(feature, version){
@@ -579,21 +621,103 @@ copy(NodeType,Node);
 copy(NodeType,Node.prototype);
 
 /**
- * @param callback return true for continue,false for break
- * @return boolean true: break visit;
+ * @param {Node} node
+ * Root of the subtree to visit.
+ * @param {function(Node): boolean} callback
+ * Called for each node in depth-first pre-order. Return a truthy value to stop traversal early.
+ * @return {boolean} `true` if traversal was aborted by the callback, `false` otherwise.
  */
-function _visitNode(node,callback){
-	if(callback(node)){
-		return true;
-	}
-	if(node = node.firstChild){
-		do{
-			if(_visitNode(node,callback)){return true}
-        }while(node=node.nextSibling)
-    }
+function _visitNode(node, callback) {
+	return walkDOM(node, null, { enter: function (n) { return callback(n) ? walkDOM.STOP : true; } }) === walkDOM.STOP;
 }
 
+/**
+ * Depth-first pre/post-order DOM tree walker.
+ *
+ * Visits every node in the subtree rooted at `node`. For each node:
+ *
+ * 1. Calls `callbacks.enter(node, context)` before descending into the node's children. The
+ * return value becomes the `context` passed to each child's `enter` call and to the matching
+ * `exit` call.
+ * 2. If `enter` returns `null` or `undefined`, the node's children are skipped;
+ * sibling traversal continues normally.
+ * 3. If `enter` returns `walkDOM.STOP`, the entire traversal is aborted immediately — no
+ * further `enter` or `exit` calls are made.
+ * 4. `lastChild` and `previousSibling` are read **after** `enter` returns, so `enter` may
+ * safely modify the node's own child list before the walker descends. Modifying siblings of
+ * the current node or any other part of the tree produces unpredictable results: nodes already
+ * queued on the stack are visited regardless of DOM changes, and newly inserted nodes outside
+ * the current child list are never visited.
+ * 5. Calls `callbacks.exit(node, context)` (if provided) after all of a node's children have
+ * been visited, passing the same `context` that `enter`
+ * returned for that node.
+ *
+ * This implementation uses an explicit stack and does not recurse — it is safe on arbitrarily
+ * deep trees.
+ *
+ * @param {Node} node
+ * Root of the subtree to walk.
+ * @param {*} context
+ * Initial context value passed to the root node's `enter`.
+ * @param {{ enter: function(Node, *): *, exit?: function(Node, *): void }} callbacks
+ * @returns {void | walkDOM.STOP}
+ * @see ../docs/walk-dom.md.
+ */
+function walkDOM(node, context, callbacks) {
+	// Each stack frame is {node, context, phase}:
+	//   walkDOM.ENTER — call enter, then push children
+	//   walkDOM.EXIT  — call exit
+	var stack = [{ node: node, context: context, phase: walkDOM.ENTER }];
+	while (stack.length > 0) {
+		var frame = stack.pop();
+		if (frame.phase === walkDOM.ENTER) {
+			var childContext = callbacks.enter(frame.node, frame.context);
+			if (childContext === walkDOM.STOP) {
+				return walkDOM.STOP;
+			}
+			// Push exit frame before children so it fires after all children are processed (Last In First Out)
+			stack.push({ node: frame.node, context: childContext, phase: walkDOM.EXIT });
+			if (childContext === null || childContext === undefined) {
+				continue; // skip children
+			}
+			// lastChild is read after enter returns, so enter may modify the child list.
+			var child = frame.node.lastChild;
+			// Traverse from lastChild backwards so that pushing onto the stack
+			// naturally yields firstChild on top (processed first).
+			while (child) {
+				stack.push({ node: child, context: childContext, phase: walkDOM.ENTER });
+				child = child.previousSibling;
+			}
+		} else {
+			// frame.phase === walkDOM.EXIT
+			if (callbacks.exit) {
+				callbacks.exit(frame.node, frame.context);
+			}
+		}
+	}
+}
 
+/**
+ * Sentinel value returned from a `walkDOM` `enter` callback to abort the entire traversal
+ * immediately.
+ *
+ * @type {symbol}
+ */
+walkDOM.STOP = Symbol('walkDOM.STOP');
+/**
+ * Phase constant for a stack frame that has not yet been visited.
+ * The `enter` callback is called and children are scheduled.
+ *
+ * @type {number}
+ */
+walkDOM.ENTER = 0;
+/**
+ * Phase constant for a stack frame whose subtree has been fully visited.
+ * The `exit` callback is called.
+ *
+ * @type {number}
+ */
+walkDOM.EXIT = 1;
 
 function Document(){
 	this.ownerDocument = this;
@@ -1218,6 +1342,23 @@ Document.prototype = {
 		node.appendData(data)
 		return node;
 	},
+	/**
+	 * Returns a ProcessingInstruction node whose target is target and data is data.
+	 *
+	 * __This implementation differs from the specification:__
+	 * - it does not do any input validation on the arguments and doesn't throw "InvalidCharacterError".
+	 *
+	 * Note: When the resulting document is serialized with `requireWellFormed: true`, the
+	 * serializer throws with code `INVALID_STATE_ERR` if `.data` contains `?>` (W3C DOM Parsing
+	 * §3.2.1.7). Without that option the data is emitted verbatim.
+	 *
+	 * @param {string} target
+	 * @param {string} data
+	 * @returns {ProcessingInstruction}
+	 * @see https://developer.mozilla.org/docs/Web/API/Document/createProcessingInstruction
+	 * @see https://dom.spec.whatwg.org/#dom-document-createprocessinginstruction
+	 * @see https://www.w3.org/TR/DOM-Parsing/#dfn-concept-serialize-xml §3.2.1.7
+	 */
 	createProcessingInstruction :	function(target,data){
 		var node = new ProcessingInstruction();
 		node.ownerDocument = this;
@@ -1449,6 +1590,19 @@ CDATASection.prototype = {
 _extends(CDATASection,CharacterData);
 
 
+/**
+ * Represents a DocumentType node (the `<!DOCTYPE ...>` declaration).
+ *
+ * `publicId`, `systemId`, and `internalSubset` are plain own-property assignments.
+ * xmldom does not enforce the `readonly` constraint declared by the WHATWG DOM spec —
+ * direct property writes succeed silently. Values are serialized verbatim when
+ * `requireWellFormed` is false (the default). When the serializer is invoked with
+ * `requireWellFormed: true` (via the 4th-parameter options object), it validates each
+ * field and throws `DOMException` with code `INVALID_STATE_ERR` on invalid values.
+ *
+ * @class
+ * @see https://developer.mozilla.org/en-US/docs/Web/API/DocumentType MDN
+ */
 function DocumentType() {
 };
 DocumentType.prototype.nodeType = DOCUMENT_TYPE_NODE;
@@ -1484,22 +1638,45 @@ function XMLSerializer(){}
 /**
  * Returns the result of serializing `node` to XML.
  *
+ * When `options.requireWellFormed` is `true`, the serializer throws for content that would
+ * produce ill-formed XML.
+ *
  * __This implementation differs from the specification:__
  * - CDATASection nodes whose data contains `]]>` are serialized by splitting the section
  *   at each `]]>` occurrence (following W3C DOM Level 3 Core `split-cdata-sections`
- *   default behaviour). A configurable option is not yet implemented.
+ *   default behaviour) unless `requireWellFormed` is `true`.
+ * - when `requireWellFormed` is `true`, `DOMException` with code `INVALID_STATE_ERR`
+ *   is only thrown to prevent injection vectors, not for all the spec mandated checks.
  *
  * @param {Node} node
  * @param {boolean} [isHtml]
  * @param {function} [nodeFilter]
+ * @param {Object} [options]
+ * @param {boolean} [options.requireWellFormed=false]
+ * When `true`, throws for content that would produce ill-formed XML.
  * @returns {string}
+ * @throws {DOMException}
+ * With code `INVALID_STATE_ERR` when `requireWellFormed` is `true` and:
+ * - a CDATASection node's data contains `"]]>"`,
+ * - a Comment node's data contains `"-->"` (bare `"--"` does not throw on this branch),
+ * - a ProcessingInstruction's data contains `"?>"`,
+ * - a DocumentType's `publicId` is non-empty and does not match the XML `PubidLiteral`
+ *   production,
+ * - a DocumentType's `systemId` is non-empty and does not match the XML `SystemLiteral`
+ *   production, or
+ * - a DocumentType's `internalSubset` contains `"]>"`.
+ * Note: xmldom does not enforce `readonly` on DocumentType fields — direct property
+ * writes succeed and are covered by the serializer-level checks above.
  * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
+ * @see https://w3c.github.io/DOM-Parsing/#xml-serialization
+ * @see https://github.com/w3c/DOM-Parsing/issues/84
  */
-XMLSerializer.prototype.serializeToString = function(node,isHtml,nodeFilter){
-	return nodeSerializeToString.call(node,isHtml,nodeFilter);
+XMLSerializer.prototype.serializeToString = function(node,isHtml,nodeFilter,options){
+	return nodeSerializeToString.call(node,isHtml,nodeFilter,options);
 }
 Node.prototype.toString = nodeSerializeToString;
-function nodeSerializeToString(isHtml,nodeFilter){
+function nodeSerializeToString(isHtml,nodeFilter,options){
+	var requireWellFormed = !!options && !!options.requireWellFormed;
 	var buf = [];
 	var refNode = this.nodeType == 9 && this.documentElement || this;
 	var prefix = refNode.prefix;
@@ -1516,7 +1693,7 @@ function nodeSerializeToString(isHtml,nodeFilter){
 			]
 		}
 	}
-	serializeToString(this,buf,isHtml,nodeFilter,visibleNamespaces);
+	serializeToString(this,buf,isHtml,nodeFilter,visibleNamespaces,requireWellFormed);
 	//console.log('###',this.nodeType,uri,prefix,buf.join(''))
 	return buf.join('');
 }
@@ -1565,272 +1742,323 @@ function addSerializedAttribute(buf, qualifiedName, value) {
 	buf.push(' ', qualifiedName, '="', value.replace(/[<>&"\t\n\r]/g, _xmlEncoder), '"')
 }
 
-function serializeToString(node,buf,isHTML,nodeFilter,visibleNamespaces){
+function serializeToString(node, buf, isHTML, nodeFilter, visibleNamespaces, requireWellFormed) {
 	if (!visibleNamespaces) {
 		visibleNamespaces = [];
 	}
-
-	if(nodeFilter){
-		node = nodeFilter(node);
-		if(node){
-			if(typeof node == 'string'){
-				buf.push(node);
-				return;
-			}
-		}else{
-			return;
-		}
-		//buf.sort.apply(attrs, attributeSorter);
-	}
-
-	switch(node.nodeType){
-	case ELEMENT_NODE:
-		var attrs = node.attributes;
-		var len = attrs.length;
-		var child = node.firstChild;
-		var nodeName = node.tagName;
-
-		isHTML = NAMESPACE.isHTML(node.namespaceURI) || isHTML
-
-		var prefixedNodeName = nodeName
-		if (!isHTML && !node.prefix && node.namespaceURI) {
-			var defaultNS
-			// lookup current default ns from `xmlns` attribute
-			for (var ai = 0; ai < attrs.length; ai++) {
-				if (attrs.item(ai).name === 'xmlns') {
-					defaultNS = attrs.item(ai).value
-					break
-				}
-			}
-			if (!defaultNS) {
-				// lookup current default ns in visibleNamespaces
-				for (var nsi = visibleNamespaces.length - 1; nsi >= 0; nsi--) {
-					var namespace = visibleNamespaces[nsi]
-					if (namespace.prefix === '' && namespace.namespace === node.namespaceURI) {
-						defaultNS = namespace.namespace
-						break
+	walkDOM(node, { ns: visibleNamespaces, isHTML: isHTML }, {
+		enter: function (n, ctx) {
+			var ns = ctx.ns;
+			var html = ctx.isHTML;
+
+			if (nodeFilter) {
+				n = nodeFilter(n);
+				if (n) {
+					if (typeof n == 'string') {
+						buf.push(n);
+						return null;
 					}
+				} else {
+					return null;
 				}
 			}
-			if (defaultNS !== node.namespaceURI) {
-				for (var nsi = visibleNamespaces.length - 1; nsi >= 0; nsi--) {
-					var namespace = visibleNamespaces[nsi]
-					if (namespace.namespace === node.namespaceURI) {
-						if (namespace.prefix) {
-							prefixedNodeName = namespace.prefix + ':' + nodeName
+
+			switch (n.nodeType) {
+				case ELEMENT_NODE:
+					var attrs = n.attributes;
+					var len = attrs.length;
+					var nodeName = n.tagName;
+
+					html = NAMESPACE.isHTML(n.namespaceURI) || html;
+
+					var prefixedNodeName = nodeName;
+					if (!html && !n.prefix && n.namespaceURI) {
+						var defaultNS;
+						// lookup current default ns from `xmlns` attribute
+						for (var ai = 0; ai < attrs.length; ai++) {
+							if (attrs.item(ai).name === 'xmlns') {
+								defaultNS = attrs.item(ai).value;
+								break;
+							}
+						}
+						if (!defaultNS) {
+							// lookup current default ns in visibleNamespaces
+							for (var nsi = ns.length - 1; nsi >= 0; nsi--) {
+								var nsEntry = ns[nsi];
+								if (nsEntry.prefix === '' && nsEntry.namespace === n.namespaceURI) {
+									defaultNS = nsEntry.namespace;
+									break;
+								}
+							}
+						}
+						if (defaultNS !== n.namespaceURI) {
+							for (var nsi = ns.length - 1; nsi >= 0; nsi--) {
+								var nsEntry = ns[nsi];
+								if (nsEntry.namespace === n.namespaceURI) {
+									if (nsEntry.prefix) {
+										prefixedNodeName = nsEntry.prefix + ':' + nodeName;
+									}
+									break;
+								}
+							}
 						}
-						break
 					}
-				}
-			}
-		}
 
-		buf.push('<', prefixedNodeName);
+					buf.push('<', prefixedNodeName);
+
+					// Build a fresh namespace snapshot for this element's children.
+					// The slice prevents sibling elements from inheriting each other's declarations.
+					var childNs = ns.slice();
+					for (var i = 0; i < len; i++) {
+						var attr = attrs.item(i);
+						if (attr.prefix == 'xmlns') {
+							childNs.push({ prefix: attr.localName, namespace: attr.value });
+						} else if (attr.nodeName == 'xmlns') {
+							childNs.push({ prefix: '', namespace: attr.value });
+						}
+					}
 
-		for(var i=0;i<len;i++){
-			// add namespaces for attributes
-			var attr = attrs.item(i);
-			if (attr.prefix == 'xmlns') {
-				visibleNamespaces.push({ prefix: attr.localName, namespace: attr.value });
-			}else if(attr.nodeName == 'xmlns'){
-				visibleNamespaces.push({ prefix: '', namespace: attr.value });
-			}
-		}
+					for (var i = 0; i < len; i++) {
+						var attr = attrs.item(i);
+						if (needNamespaceDefine(attr, html, childNs)) {
+							var attrPrefix = attr.prefix || '';
+							var uri = attr.namespaceURI;
+							addSerializedAttribute(buf, attrPrefix ? 'xmlns:' + attrPrefix : 'xmlns', uri);
+							childNs.push({ prefix: attrPrefix, namespace: uri });
+						}
+						// Apply nodeFilter and serialize the attribute.
+						var filteredAttr = nodeFilter ? nodeFilter(attr) : attr;
+						if (filteredAttr) {
+							if (typeof filteredAttr === 'string') {
+								buf.push(filteredAttr);
+							} else {
+								addSerializedAttribute(buf, filteredAttr.name, filteredAttr.value);
+							}
+						}
+					}
 
-		for(var i=0;i<len;i++){
-			var attr = attrs.item(i);
-			if (needNamespaceDefine(attr,isHTML, visibleNamespaces)) {
-				var prefix = attr.prefix||'';
-				var uri = attr.namespaceURI;
-				addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
-				visibleNamespaces.push({ prefix: prefix, namespace:uri });
-			}
-			serializeToString(attr,buf,isHTML,nodeFilter,visibleNamespaces);
-		}
+					// add namespace for current node
+					if (nodeName === prefixedNodeName && needNamespaceDefine(n, html, childNs)) {
+						var nodePrefix = n.prefix || '';
+						var uri = n.namespaceURI;
+						addSerializedAttribute(buf, nodePrefix ? 'xmlns:' + nodePrefix : 'xmlns', uri);
+						childNs.push({ prefix: nodePrefix, namespace: uri });
+					}
 
-		// add namespace for current node
-		if (nodeName === prefixedNodeName && needNamespaceDefine(node, isHTML, visibleNamespaces)) {
-			var prefix = node.prefix||'';
-			var uri = node.namespaceURI;
-			addSerializedAttribute(buf, prefix ? 'xmlns:' + prefix : "xmlns", uri);
-			visibleNamespaces.push({ prefix: prefix, namespace:uri });
-		}
+					var child = n.firstChild;
+					if (child || html && !/^(?:meta|link|img|br|hr|input)$/i.test(nodeName)) {
+						buf.push('>');
+						if (html && /^script$/i.test(nodeName)) {
+							// Inline serialization for <script> children; return null to skip walkDOM descent.
+							while (child) {
+								if (child.data) {
+									buf.push(child.data);
+								} else {
+									serializeToString(child, buf, html, nodeFilter, childNs.slice(), requireWellFormed);
+								}
+								child = child.nextSibling;
+							}
+							buf.push('</', nodeName, '>');
+							return null;
+						}
+						// Return child context; walkDOM descends and exit emits the closing tag.
+						return { ns: childNs, isHTML: html, tag: prefixedNodeName };
+					} else {
+						buf.push('/>');
+						return null;
+					}
 
-		if(child || isHTML && !/^(?:meta|link|img|br|hr|input)$/i.test(nodeName)){
-			buf.push('>');
-			//if is cdata child node
-			if(isHTML && /^script$/i.test(nodeName)){
-				while(child){
-					if(child.data){
-						buf.push(child.data);
-					}else{
-						serializeToString(child, buf, isHTML, nodeFilter, visibleNamespaces.slice());
+				case DOCUMENT_NODE:
+				case DOCUMENT_FRAGMENT_NODE:
+					// Descend into children; exit is a no-op (tag is null).
+					return { ns: ns.slice(), isHTML: html, tag: null };
+
+				case ATTRIBUTE_NODE:
+					addSerializedAttribute(buf, n.name, n.value);
+					return null;
+
+				case TEXT_NODE:
+					/**
+					 * The ampersand character (&) and the left angle bracket (<) must not appear in their literal form,
+					 * except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section.
+					 * If they are needed elsewhere, they must be escaped using either numeric character references or the strings
+					 * `&amp;` and `&lt;` respectively.
+					 * The right angle bracket (>) may be represented using the string " &gt; ", and must, for compatibility,
+					 * be escaped using either `&gt;` or a character reference when it appears in the string `]]>` in content,
+					 * when that string is not marking the end of a CDATA section.
+					 *
+					 * In the content of elements, character data is any string of characters
+					 * which does not contain the start-delimiter of any markup
+					 * and does not include the CDATA-section-close delimiter, `]]>`.
+					 *
+					 * @see https://www.w3.org/TR/xml/#NT-CharData
+					 * @see https://w3c.github.io/DOM-Parsing/#xml-serializing-a-text-node
+					 */
+					buf.push(n.data.replace(/[<&>]/g, _xmlEncoder));
+					return null;
+
+				case CDATA_SECTION_NODE:
+					if (requireWellFormed && n.data.indexOf(']]>') !== -1) {
+						throw new DOMException(INVALID_STATE_ERR, 'The CDATASection data contains "]]>"');
 					}
-					child = child.nextSibling;
-				}
-			}else
-			{
-				while(child){
-					serializeToString(child, buf, isHTML, nodeFilter, visibleNamespaces.slice());
-					child = child.nextSibling;
-				}
-			}
-			buf.push('</',prefixedNodeName,'>');
-		}else{
-			buf.push('/>');
-		}
-		// remove added visible namespaces
-		//visibleNamespaces.length = startVisibleNamespaces;
-		return;
-	case DOCUMENT_NODE:
-	case DOCUMENT_FRAGMENT_NODE:
-		var child = node.firstChild;
-		while(child){
-			serializeToString(child, buf, isHTML, nodeFilter, visibleNamespaces.slice());
-			child = child.nextSibling;
-		}
-		return;
-	case ATTRIBUTE_NODE:
-		return addSerializedAttribute(buf, node.name, node.value);
-	case TEXT_NODE:
-		/**
-		 * The ampersand character (&) and the left angle bracket (<) must not appear in their literal form,
-		 * except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section.
-		 * If they are needed elsewhere, they must be escaped using either numeric character references or the strings
-		 * `&amp;` and `&lt;` respectively.
-		 * The right angle bracket (>) may be represented using the string " &gt; ", and must, for compatibility,
-		 * be escaped using either `&gt;` or a character reference when it appears in the string `]]>` in content,
-		 * when that string is not marking the end of a CDATA section.
-		 *
-		 * In the content of elements, character data is any string of characters
-		 * which does not contain the start-delimiter of any markup
-		 * and does not include the CDATA-section-close delimiter, `]]>`.
-		 *
-		 * @see https://www.w3.org/TR/xml/#NT-CharData
-		 * @see https://w3c.github.io/DOM-Parsing/#xml-serializing-a-text-node
-		 */
-		return buf.push(node.data
-			.replace(/[<&>]/g,_xmlEncoder)
-		);
-	case CDATA_SECTION_NODE:
-		return buf.push('<![CDATA[', node.data.replace(/]]>/g, ']]]]><![CDATA[>'), ']]>');
-	case COMMENT_NODE:
-		return buf.push( "<!--",node.data,"-->");
-	case DOCUMENT_TYPE_NODE:
-		var pubid = node.publicId;
-		var sysid = node.systemId;
-		buf.push('<!DOCTYPE ',node.name);
-		if(pubid){
-			buf.push(' PUBLIC ', pubid);
-			if (sysid && sysid!='.') {
-				buf.push(' ', sysid);
+					buf.push('<![CDATA[', n.data.replace(/]]>/g, ']]]]><![CDATA[>'), ']]>');
+					return null;
+
+				case COMMENT_NODE:
+					if (requireWellFormed && n.data.indexOf('-->') !== -1) {
+						throw new DOMException(INVALID_STATE_ERR, 'The comment node data contains "-->"');
+					}
+					buf.push('<!--', n.data, '-->');
+					return null;
+
+				case DOCUMENT_TYPE_NODE:
+					if (requireWellFormed) {
+						if (n.publicId && !/^("[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%']*"|'[\x20\r\na-zA-Z0-9\-()+,.\/:=?;!*#@$_%'"]*')$/.test(n.publicId)) {
+							throw new DOMException(INVALID_STATE_ERR, 'DocumentType publicId is not a valid PubidLiteral');
+						}
+						if (n.systemId && !/^("[^"]*"|'[^']*')$/.test(n.systemId)) {
+							throw new DOMException(INVALID_STATE_ERR, 'DocumentType systemId is not a valid SystemLiteral');
+						}
+						if (n.internalSubset && n.internalSubset.indexOf(']>') !== -1) {
+							throw new DOMException(INVALID_STATE_ERR, 'DocumentType internalSubset contains "]>"');
+						}
+					}
+					var pubid = n.publicId;
+					var sysid = n.systemId;
+					buf.push('<!DOCTYPE ', n.name);
+					if (pubid) {
+						buf.push(' PUBLIC ', pubid);
+						if (sysid && sysid != '.') {
+							buf.push(' ', sysid);
+						}
+						buf.push('>');
+					} else if (sysid && sysid != '.') {
+						buf.push(' SYSTEM ', sysid, '>');
+					} else {
+						var sub = n.internalSubset;
+						if (sub) {
+							buf.push(' [', sub, ']');
+						}
+						buf.push('>');
+					}
+					return null;
+
+				case PROCESSING_INSTRUCTION_NODE:
+					if (requireWellFormed && n.data.indexOf('?>') !== -1) {
+						throw new DOMException(INVALID_STATE_ERR, 'The ProcessingInstruction data contains "?>"');
+					}
+					buf.push('<?', n.target, ' ', n.data, '?>');
+					return null;
+
+				case ENTITY_REFERENCE_NODE:
+					buf.push('&', n.nodeName, ';');
+					return null;
+
+				//case ENTITY_NODE:
+				//case NOTATION_NODE:
+				default:
+					buf.push('??', n.nodeName);
+					return null;
 			}
-			buf.push('>');
-		}else if(sysid && sysid!='.'){
-			buf.push(' SYSTEM ', sysid, '>');
-		}else{
-			var sub = node.internalSubset;
-			if(sub){
-				buf.push(" [",sub,"]");
+		},
+		exit: function (n, childCtx) {
+			if (childCtx && childCtx.tag) {
+				buf.push('</', childCtx.tag, '>');
 			}
-			buf.push(">");
-		}
-		return;
-	case PROCESSING_INSTRUCTION_NODE:
-		return buf.push( "<?",node.target," ",node.data,"?>");
-	case ENTITY_REFERENCE_NODE:
-		return buf.push( '&',node.nodeName,';');
-	//case ENTITY_NODE:
-	//case NOTATION_NODE:
-	default:
-		buf.push('??',node.nodeName);
-	}
+		},
+	});
 }
-function importNode(doc,node,deep){
-	var node2;
-	switch (node.nodeType) {
-	case ELEMENT_NODE:
-		node2 = node.cloneNode(false);
-		node2.ownerDocument = doc;
-		//var attrs = node2.attributes;
-		//var len = attrs.length;
-		//for(var i=0;i<len;i++){
-			//node2.setAttributeNodeNS(importNode(doc,attrs.item(i),deep));
-		//}
-	case DOCUMENT_FRAGMENT_NODE:
-		break;
-	case ATTRIBUTE_NODE:
-		deep = true;
-		break;
-	//case ENTITY_REFERENCE_NODE:
-	//case PROCESSING_INSTRUCTION_NODE:
-	////case TEXT_NODE:
-	//case CDATA_SECTION_NODE:
-	//case COMMENT_NODE:
-	//	deep = false;
-	//	break;
-	//case DOCUMENT_NODE:
-	//case DOCUMENT_TYPE_NODE:
-	//cannot be imported.
-	//case ENTITY_NODE:
-	//case NOTATION_NODE：
-	//can not hit in level3
-	//default:throw e;
-	}
-	if(!node2){
-		node2 = node.cloneNode(false);//false
-	}
-	node2.ownerDocument = doc;
-	node2.parentNode = null;
-	if(deep){
-		var child = node.firstChild;
-		while(child){
-			node2.appendChild(importNode(doc,child,deep));
-			child = child.nextSibling;
-		}
-	}
-	return node2;
+/**
+ * Imports a node from a different document into `doc`, creating a new copy.
+ * Delegates to {@link walkDOM} for traversal. Each node in the subtree is shallow-cloned,
+ * stamped with `doc` as its `ownerDocument`, and detached (`parentNode` set to `null`).
+ * Children are imported recursively when `deep` is `true`; for {@link Attr} nodes `deep` is
+ * always forced to `true`
+ * because an attribute's value lives in a child text node.
+ *
+ * @param {Document} doc
+ * The document that will own the imported node.
+ * @param {Node} node
+ * The node to import.
+ * @param {boolean} deep
+ * If `true`, descendants are imported recursively.
+ * @returns {Node}
+ * The newly imported node, now owned by `doc`.
+ */
+function importNode(doc, node, deep) {
+	var destRoot;
+	walkDOM(node, null, {
+		enter: function (srcNode, destParent) {
+			// Shallow-clone the node and stamp it into the target document.
+			var destNode = srcNode.cloneNode(false);
+			destNode.ownerDocument = doc;
+			destNode.parentNode = null;
+			// capture as the root of the imported subtree or attach to parent.
+			if (destParent === null) {
+				destRoot = destNode;
+			} else {
+				destParent.appendChild(destNode);
+			}
+			// ATTRIBUTE_NODE must always be imported deeply: its value lives in a child text node.
+			var shouldDeep = srcNode.nodeType === ATTRIBUTE_NODE || deep;
+			return shouldDeep ? destNode : null;
+		},
+	});
+	return destRoot;
 }
 //
 //var _relationMap = {firstChild:1,lastChild:1,previousSibling:1,nextSibling:1,
 //					attributes:1,childNodes:1,parentNode:1,documentElement:1,doctype,};
-function cloneNode(doc,node,deep){
-	var node2 = new node.constructor();
-	for (var n in node) {
-		if (Object.prototype.hasOwnProperty.call(node, n)) {
-			var v = node[n];
-			if (typeof v != "object") {
-				if (v != node2[n]) {
-					node2[n] = v;
+function cloneNode(doc, node, deep) {
+	var destRoot;
+	walkDOM(node, null, {
+		enter: function (srcNode, destParent) {
+			// 1. Create a blank node of the same type and copy all scalar own properties.
+			var destNode = new srcNode.constructor();
+			for (var n in srcNode) {
+				if (Object.prototype.hasOwnProperty.call(srcNode, n)) {
+					var v = srcNode[n];
+					if (typeof v != 'object') {
+						if (v != destNode[n]) {
+							destNode[n] = v;
+						}
+					}
 				}
 			}
-		}
-	}
-	if(node.childNodes){
-		node2.childNodes = new NodeList();
-	}
-	node2.ownerDocument = doc;
-	switch (node2.nodeType) {
-	case ELEMENT_NODE:
-		var attrs	= node.attributes;
-		var attrs2	= node2.attributes = new NamedNodeMap();
-		var len = attrs.length
-		attrs2._ownerElement = node2;
-		for(var i=0;i<len;i++){
-			node2.setAttributeNode(cloneNode(doc,attrs.item(i),true));
-		}
-		break;;
-	case ATTRIBUTE_NODE:
-		deep = true;
-	}
-	if(deep){
-		var child = node.firstChild;
-		while(child){
-			node2.appendChild(cloneNode(doc,child,deep));
-			child = child.nextSibling;
-		}
-	}
-	return node2;
+			if (srcNode.childNodes) {
+				destNode.childNodes = new NodeList();
+			}
+			destNode.ownerDocument = doc;
+			// 2. Handle node-type-specific setup.
+			//    Attributes are not DOM children, so they are cloned inline here
+			//    rather than by walkDOM descent.
+			//    ATTRIBUTE_NODE forces deep=true so its own children are walked.
+			var shouldDeep = deep;
+			switch (destNode.nodeType) {
+				case ELEMENT_NODE:
+					var attrs = srcNode.attributes;
+					var attrs2 = (destNode.attributes = new NamedNodeMap());
+					var len = attrs.length;
+					attrs2._ownerElement = destNode;
+					for (var i = 0; i < len; i++) {
+						destNode.setAttributeNode(cloneNode(doc, attrs.item(i), true));
+					}
+					break;
+				case ATTRIBUTE_NODE:
+					shouldDeep = true;
+			}
+			// 3. Attach to parent, or capture as the root of the cloned subtree.
+			if (destParent !== null) {
+				destParent.appendChild(destNode);
+			} else {
+				destRoot = destNode;
+			}
+			// 4. Return destNode as the context for children (causes walkDOM to descend),
+			//    or null to skip children (shallow clone).
+			return shouldDeep ? destNode : null;
+		},
+	});
+	return destRoot;
 }
 
 function __set__(object,key,value){
@@ -1846,49 +2074,55 @@ try{
 			}
 		});
 
-		Object.defineProperty(Node.prototype,'textContent',{
-			get:function(){
-				return getTextContent(this);
+		/**
+		 * The text content of this node and its descendants.
+		 *
+		 * Setting `textContent` on an element or document fragment replaces all child nodes with a
+		 * single text node; on other nodes it sets `data`, `value`, and `nodeValue` directly.
+		 *
+		 * @type {string | null}
+		 * @see {@link https://dom.spec.whatwg.org/#dom-node-textcontent}
+		 */
+		Object.defineProperty(Node.prototype, 'textContent', {
+			get: function () {
+				if (this.nodeType === ELEMENT_NODE || this.nodeType === DOCUMENT_FRAGMENT_NODE) {
+					var buf = [];
+					walkDOM(this, null, {
+						enter: function (n) {
+							if (n.nodeType === ELEMENT_NODE || n.nodeType === DOCUMENT_FRAGMENT_NODE) {
+								return true; // enter children
+							}
+							if (n.nodeType === PROCESSING_INSTRUCTION_NODE || n.nodeType === COMMENT_NODE) {
+								return null; // excluded from text content
+							}
+							buf.push(n.nodeValue);
+						},
+					});
+					return buf.join('');
+				}
+				return this.nodeValue;
 			},
 
-			set:function(data){
-				switch(this.nodeType){
-				case ELEMENT_NODE:
-				case DOCUMENT_FRAGMENT_NODE:
-					while(this.firstChild){
-						this.removeChild(this.firstChild);
-					}
-					if(data || String(data)){
-						this.appendChild(this.ownerDocument.createTextNode(data));
-					}
-					break;
+			set: function (data) {
+				switch (this.nodeType) {
+					case ELEMENT_NODE:
+					case DOCUMENT_FRAGMENT_NODE:
+						while (this.firstChild) {
+							this.removeChild(this.firstChild);
+						}
+						if (data || String(data)) {
+							this.appendChild(this.ownerDocument.createTextNode(data));
+						}
+						break;
 
-				default:
-					this.data = data;
-					this.value = data;
-					this.nodeValue = data;
+					default:
+						this.data = data;
+						this.value = data;
+						this.nodeValue = data;
 				}
-			}
+			},
 		})
 
-		function getTextContent(node){
-			switch(node.nodeType){
-			case ELEMENT_NODE:
-			case DOCUMENT_FRAGMENT_NODE:
-				var buf = [];
-				node = node.firstChild;
-				while(node){
-					if(node.nodeType!==7 && node.nodeType !==8){
-						buf.push(getTextContent(node));
-					}
-					node = node.nextSibling;
-				}
-				return buf.join('');
-			default:
-				return node.nodeValue;
-			}
-		}
-
 		__set__ = function(object,key,value){
 			//console.log(value)
 			object['$$'+key] = value
@@ -1904,5 +2138,6 @@ try{
 	exports.Element = Element;
 	exports.Node = Node;
 	exports.NodeList = NodeList;
+	exports.walkDOM = walkDOM;
 	exports.XMLSerializer = XMLSerializer;
 //}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xmldom/xmldom",
-	"version": "0.8.12",
+	"version": "0.8.13",
 	"description": "A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.",
 	"keywords": [
 		"w3c",
@@ -27,6 +27,9 @@
 		"index.d.ts",
 		"lib"
 	],
+	"config": {
+		"test_stack_size": 256
+	},
 	"scripts": {
 		"lint": "eslint lib test",
 		"format": "prettier --write test",
@@ -35,7 +38,7 @@
 		"start": "nodemon --watch package.json --watch lib --watch test --exec 'npm --silent run test && npm --silent run lint'",
 		"stryker": "stryker run",
 		"stryker:dry-run": "stryker run -m '' --reporters progress",
-		"test": "jest",
+		"test": "node --stack-size=$npm_package_config_test_stack_size ./node_modules/.bin/jest",
 		"testrelease": "npm test && eslint lib",
 		"version": "./changelog-has-version.sh",
 		"release": "np --no-yarn --test-script testrelease --branch release-0.8.x patch"