@xmldom/xmldom 0.9.7 → 0.9.9

package/CHANGELOG.md

@@ -4,6 +4,72 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.9](https://github.com/xmldom/xmldom/compare/0.9.8...0.9.9)
+
+### Added
+
+- implement `ParentNode.children` getter [`#960`](https://github.com/xmldom/xmldom/pull/960) / [`#410`](https://github.com/xmldom/xmldom/issues/410)
+
+### Fixed
+
+- Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
+- Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
+- correctly traverse ancestor chain in `Node.contains` [`#931`](https://github.com/xmldom/xmldom/pull/931)
+
+Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.
+
+### Chore
+
+- updated dependencies
+
+Thank you,
+[@stevenobiajulu](https://github.com/stevenobiajulu),
+[@yoshi389111](https://github.com/yoshi389111),
+[@thesmartshadow](https://github.com/thesmartshadow),
+for your contributions
+
+
+## [0.8.12](https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12)
+
+### Fixed
+
+- preserve trailing whitespace in ProcessingInstruction data [`#962`](https://github.com/xmldom/xmldom/pull/962) / [`#42`](https://github.com/xmldom/xmldom/issues/42)
+- Security: `createCDATASection` now throws `InvalidCharacterError` when `data` contains `"]]>"`, as required by the [WHATWG DOM spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
+- Security: `XMLSerializer` now splits CDATASection nodes whose data contains `"]]>"` into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (`appendData`, `replaceData`, `.data =`, `.textContent =`). [`GHSA-wh4c-j3r5-mjhp`](https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
+
+Code that passes a string containing `"]]>"` to `createCDATASection` and relied on the previously unsafe behavior will now receive `InvalidCharacterError`. Use a mutation method such as `appendData` if you intentionally need `"]]>"` in a CDATASection node's data.
+
+Thank you,
+[@thesmartshadow](https://github.com/thesmartshadow),
+[@stevenobiajulu](https://github.com/stevenobiajulu),
+for your contributions
+
+## [0.8.11](https://github.com/xmldom/xmldom/compare/0.8.10...0.8.11)
+
+### Fixed
+
+- update `ownerDocument` when moving nodes between documents [`#933`](https://github.com/xmldom/xmldom/pull/933) / [`#932`](https://github.com/xmldom/xmldom/issues/932)
+
+Thank you, [@shunkica](https://github.com/shunkica), for your contributions
+
+## [0.9.8](https://github.com/xmldom/xmldom/compare/0.9.8...0.9.7)
+
+### Fixed
+
+- fix: replace \u2029 as part of normalizeLineEndings [`#839`](https://github.com/xmldom/xmldom/pull/839) / [`#838`](https://github.com/xmldom/xmldom/issues/838)
+- perf: speed up line detection [`#847`](https://github.com/xmldom/xmldom/pull/847) / [`#838`](https://github.com/xmldom/xmldom/issues/838)
+
+### Chore
+
+- updated dependencies
+- drop jazzer and rxjs devDependencies [`#845`](https://github.com/xmldom/xmldom/pull/845)
+
+Thank you,
+[@kboshold](https://github.com/kboshold),
+[@Ponynjaa](https://github.com/Ponynjaa),
+for your contributions.
+
+
 ## [0.9.7](https://github.com/xmldom/xmldom/compare/0.9.6...0.9.7)
 
 ### Added

package/index.d.ts

@@ -827,6 +827,15 @@ declare module '@xmldom/xmldom' {
 		 */
 		readonly tagName: string;
 
+		/**
+		 * Returns a live collection of the direct child elements of this element.
+		 *
+		 * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Element/children)
+		 *
+		 * @see https://dom.spec.whatwg.org/#dom-parentnode-children
+		 */
+		readonly children: LiveNodeList<Element>;
+
 		/**
 		 * Returns element's first attribute whose qualified name is qualifiedName, and null if there
 		 * is no such attribute otherwise.
@@ -1085,6 +1094,16 @@ declare module '@xmldom/xmldom' {
 	 */
 	interface DocumentFragment extends Node {
 		readonly ownerDocument: Document;
+
+		/**
+		 * Returns a live collection of the direct child elements of this document fragment.
+		 *
+		 * [MDN Reference](https://developer.mozilla.org/docs/Web/API/DocumentFragment/children)
+		 *
+		 * @see https://dom.spec.whatwg.org/#dom-parentnode-children
+		 */
+		readonly children: LiveNodeList<Element>;
+
 		getElementById(elementId: string): Element | null;
 	}
 	var DocumentFragment: InstanceOf<DocumentFragment>;
@@ -1152,6 +1171,15 @@ declare module '@xmldom/xmldom' {
 		 */
 		readonly documentElement: Element | null;
 
+		/**
+		 * Returns a live collection of the direct child elements of this document.
+		 *
+		 * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Document/children)
+		 *
+		 * @see https://dom.spec.whatwg.org/#dom-parentnode-children
+		 */
+		readonly children: LiveNodeList<Element>;
+
 		/**
 		 * Creates an attribute object with a specified name.
 		 *
@@ -1163,9 +1191,15 @@ declare module '@xmldom/xmldom' {
 		createAttributeNS(namespace: string | null, qualifiedName: string): Attr;
 
 		/**
-		 * Returns a CDATASection node whose data is data.
+		 * Returns a new CDATASection node whose data is `data`.
 		 *
-		 * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Document/createCDATASection)
+		 * __This implementation differs from the specification:__ - calling this method on an HTML
+		 * document does not throw `NotSupportedError`.
+		 *
+		 * @throws {DOMException}
+		 * With code `INVALID_CHARACTER_ERR` if `data` contains `"]]>"`.
+		 * @see https://developer.mozilla.org/en-US/docs/Web/API/Document/createCDATASection
+		 * @see https://dom.spec.whatwg.org/#dom-document-createcdatasection
 		 */
 		createCDATASection(data: string): CDATASection;
 
@@ -1430,6 +1464,16 @@ declare module '@xmldom/xmldom' {
 	}
 
 	class XMLSerializer {
+		/**
+		 * Returns the result of serializing `node` to XML.
+		 *
+		 * __This implementation differs from the specification:__ - CDATASection nodes whose data
+		 * contains `]]>` are serialized by splitting the section at each `]]>` occurrence (following
+		 * W3C DOM Level 3 Core `split-cdata-sections`
+		 * default behaviour). A configurable option is not yet implemented.
+		 *
+		 * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
+		 */
 		serializeToString(node: Node, nodeFilter?: (node: Node) => boolean): string;
 	}
 	// END ./lib/dom.js
@@ -1527,12 +1571,15 @@ declare module '@xmldom/xmldom' {
 		readonly locator?: boolean;
 
 		/**
-		 * used to replace line endings before parsing, defaults to `normalizeLineEndings`,
-		 * which normalizes line endings according to <https://www.w3.org/TR/xml11/#sec-line-ends>.
+		 * used to replace line endings before parsing, defaults to exported `normalizeLineEndings`,
+		 * which normalizes line endings according to <https://www.w3.org/TR/xml11/#sec-line-ends>,
+		 * including some Unicode "newline" characters.
+		 *
+		 * @see {@link normalizeLineEndings}
 		 */
 		readonly normalizeLineEndings?: (source: string) => string;
 		/**
-		 * A function that is invoked for every error that occurs during parsing.
+		 * A function invoked for every error that occurs during parsing.
 		 *
 		 * If it is not provided, all errors are reported to `console.error`
 		 * and only `fatalError`s are thrown as a `ParseError`,
@@ -1572,6 +1619,29 @@ declare module '@xmldom/xmldom' {
 		): void;
 	}
 
+	/**
+	 * Normalizes line ending according to <https://www.w3.org/TR/xml11/#sec-line-ends>,
+	 * including some Unicode "newline" characters:
+	 *
+	 * > XML parsed entities are often stored in computer files which,
+	 * > for editing convenience, are organized into lines.
+	 * > These lines are typically separated by some combination
+	 * > of the characters CARRIAGE RETURN (#xD) and LINE FEED (#xA).
+	 * >
+	 * > To simplify the tasks of applications, the XML processor must behave
+	 * > as if it normalized all line breaks in external parsed entities (including the document entity)
+	 * > on input, before parsing, by translating the following to a single #xA character:
+	 * >
+	 * > 1. the two-character sequence #xD #xA,
+	 * > 2. the two-character sequence #xD #x85,
+	 * > 3. the single character #x85,
+	 * > 4. the single character #x2028,
+	 * > 5. the single character #x2029,
+	 * > 6. any #xD character that is not immediately followed by #xA or #x85.
+	 *
+	 * @prettierignore
+	 */
+	function normalizeLineEndings(input: string): string;
 	/**
 	 * A method that prevents any further parsing when an `error`
 	 * with level `error` is reported during parsing.

package/lib/dom-parser.js

@@ -18,7 +18,8 @@ var ParseError = errors.ParseError;
 var XMLReader = sax.XMLReader;
 
 /**
- * Normalizes line ending according to <https://www.w3.org/TR/xml11/#sec-line-ends>:
+ * Normalizes line ending according to <https://www.w3.org/TR/xml11/#sec-line-ends>,
+ * including some Unicode "newline" characters:
  *
  * > XML parsed entities are often stored in computer files which,
  * > for editing convenience, are organized into lines.
@@ -27,20 +28,21 @@ var XMLReader = sax.XMLReader;
  * >
  * > To simplify the tasks of applications, the XML processor must behave
  * > as if it normalized all line breaks in external parsed entities (including the document entity)
- * > on input, before parsing, by translating all of the following to a single #xA character:
+ * > on input, before parsing, by translating the following to a single #xA character:
  * >
  * > 1. the two-character sequence #xD #xA,
  * > 2. the two-character sequence #xD #x85,
  * > 3. the single character #x85,
  * > 4. the single character #x2028,
- * > 5. any #xD character that is not immediately followed by #xA or #x85.
+ * > 5. the single character #x2029,
+ * > 6. any #xD character that is not immediately followed by #xA or #x85.
  *
  * @param {string} input
  * @returns {string}
  * @prettierignore
  */
 function normalizeLineEndings(input) {
-	return input.replace(/\r[\n\u0085]/g, '\n').replace(/[\r\u0085\u2028]/g, '\n');
+	return input.replace(/\r[\n\u0085]/g, '\n').replace(/[\r\u0085\u2028\u2029]/g, '\n');
 }
 
 /**
@@ -63,7 +65,7 @@ function normalizeLineEndings(input) {
  * DEPRECATED! use `onError` instead.
  * @property {function(level:ErrorLevel, message:string, context: DOMHandler):void}
  * [onError]
- * A function that is invoked for every error that occurs during parsing.
+ * A function invoked for every error that occurs during parsing.
  *
  * If it is not provided, all errors are reported to `console.error`
  * and only `fatalError`s are thrown as a `ParseError`,
@@ -78,7 +80,9 @@ function normalizeLineEndings(input) {
  * attribute describing their location in the XML string.
  * Default is true.
  * @property {(string) => string} [normalizeLineEndings]
- * used to replace line endings before parsing, defaults to `normalizeLineEndings`
+ * used to replace line endings before parsing, defaults to exported `normalizeLineEndings`,
+ * which normalizes line endings according to <https://www.w3.org/TR/xml11/#sec-line-ends>,
+ * including some Unicode "newline" characters.
  * @property {Object} [xmlns]
  * The XML namespaces that should be assumed when parsing.
  * The default namespace can be provided by the key that is the empty string.

package/lib/dom.js

@@ -1082,7 +1082,7 @@ Node.prototype = {
 		var parent = other;
 		do {
 			if (this === parent) return true;
-			parent = other.parentNode;
+			parent = parent.parentNode;
 		} while (parent);
 		return false;
 	},
@@ -2210,10 +2210,22 @@ Document.prototype = {
 		return node;
 	},
 	/**
+	 * Returns a new CDATASection node whose data is `data`.
+	 *
+	 * __This implementation differs from the specification:__ - calling this method on an HTML
+	 * document does not throw `NotSupportedError`.
+	 *
 	 * @param {string} data
 	 * @returns {CDATASection}
+	 * @throws {DOMException}
+	 * With code `INVALID_CHARACTER_ERR` if `data` contains `"]]>"`.
+	 * @see https://developer.mozilla.org/en-US/docs/Web/API/Document/createCDATASection
+	 * @see https://dom.spec.whatwg.org/#dom-document-createcdatasection
 	 */
 	createCDATASection: function (data) {
+		if (data.indexOf(']]>') !== -1) {
+			throw new DOMException(DOMException.INVALID_CHARACTER_ERR, 'data contains "]]>"');
+		}
 		var node = new CDATASection(PDC);
 		node.ownerDocument = this;
 		node.childNodes = new NodeList();
@@ -2693,6 +2705,19 @@ function ProcessingInstruction(symbol) {
 ProcessingInstruction.prototype.nodeType = PROCESSING_INSTRUCTION_NODE;
 _extends(ProcessingInstruction, CharacterData);
 function XMLSerializer() {}
+/**
+ * Returns the result of serializing `node` to XML.
+ *
+ * __This implementation differs from the specification:__ - CDATASection nodes whose data
+ * contains `]]>` are serialized by splitting the section at each `]]>` occurrence (following
+ * W3C DOM Level 3 Core `split-cdata-sections`
+ * default behaviour). A configurable option is not yet implemented.
+ *
+ * @param {Node} node
+ * @param {function} [nodeFilter]
+ * @returns {string}
+ * @see https://html.spec.whatwg.org/#dom-xmlserializer-serializetostring
+ */
 XMLSerializer.prototype.serializeToString = function (node, nodeFilter) {
 	return nodeSerializeToString.call(node, nodeFilter);
 };
@@ -2917,7 +2942,7 @@ function serializeToString(node, buf, nodeFilter, visibleNamespaces) {
 			 */
 			return buf.push(node.data.replace(/[<&>]/g, _xmlEncoder));
 		case CDATA_SECTION_NODE:
-			return buf.push(g.CDATA_START, node.data, g.CDATA_END);
+			return buf.push(g.CDATA_START, node.data.replace(/]]>/g, ']]]]><![CDATA[>'), g.CDATA_END);
 		case COMMENT_NODE:
 			return buf.push(g.COMMENT_START, node.data, g.COMMENT_END);
 		case DOCUMENT_TYPE_NODE:
@@ -3051,6 +3076,22 @@ function cloneNode(doc, node, deep) {
 function __set__(object, key, value) {
 	object[key] = value;
 }
+
+// Returns a new array of direct Element children.
+// Passed to LiveNodeList to implement ParentNode.children.
+// https://dom.spec.whatwg.org/#dom-parentnode-children
+function childrenRefresh(node) {
+	var ls = [];
+	var child = node.firstChild;
+	while (child) {
+		if (child.nodeType === ELEMENT_NODE) {
+			ls.push(child);
+		}
+		child = child.nextSibling;
+	}
+	return ls;
+}
+
 //do dynamic
 try {
 	if (Object.defineProperty) {
@@ -3104,6 +3145,22 @@ try {
 			}
 		}
 
+		Object.defineProperty(Element.prototype, 'children', {
+			get: function () {
+				return new LiveNodeList(this, childrenRefresh);
+			},
+		});
+		Object.defineProperty(Document.prototype, 'children', {
+			get: function () {
+				return new LiveNodeList(this, childrenRefresh);
+			},
+		});
+		Object.defineProperty(DocumentFragment.prototype, 'children', {
+			get: function () {
+				return new LiveNodeList(this, childrenRefresh);
+			},
+		});
+
 		__set__ = function (object, key, value) {
 			//console.log(value)
 			object['$$' + key] = value;

package/lib/index.js

@@ -36,5 +36,6 @@ exports.XMLSerializer = dom.XMLSerializer;
 
 var domParser = require('./dom-parser');
 exports.DOMParser = domParser.DOMParser;
+exports.normalizeLineEndings = domParser.normalizeLineEndings;
 exports.onErrorStopParsing = domParser.onErrorStopParsing;
 exports.onWarningStopParsing = domParser.onWarningStopParsing;

package/lib/sax.js

@@ -81,7 +81,7 @@ function parse(source, defaultNSMapCopy, entityMap, domBuilder, errorHandler) {
 		if (hasOwn(entityMap, k)) {
 			return entityMap[k];
 		} else if (k.charAt(0) === '#') {
-			return fixedFromCharCode(parseInt(k.substr(1).replace('x', '0x')));
+			return fixedFromCharCode(parseInt(k.substring(1).replace('x', '0x')));
 		} else {
 			errorHandler.error('entity not found:' + a);
 			return a;
@@ -98,20 +98,20 @@ function parse(source, defaultNSMapCopy, entityMap, domBuilder, errorHandler) {
 		}
 	}
 
+	var lineStart = 0;
+	var lineEnd = 0;
+	var linePattern = /\r\n?|\n|$/g;
+	var locator = domBuilder.locator;
+
 	function position(p, m) {
 		while (p >= lineEnd && (m = linePattern.exec(source))) {
-			lineStart = m.index;
-			lineEnd = lineStart + m[0].length;
+			lineStart = lineEnd;
+			lineEnd = m.index + m[0].length;
 			locator.lineNumber++;
 		}
 		locator.columnNumber = p - lineStart + 1;
 	}
 
-	var lineStart = 0;
-	var lineEnd = 0;
-	var linePattern = /.*(?:\r\n?|\n)|.*$/g;
-	var locator = domBuilder.locator;
-
 	var parseStack = [{ currentNSMap: defaultNSMapCopy }];
 	var unclosedTags = [];
 	var start = 0;
@@ -124,7 +124,7 @@ function parse(source, defaultNSMapCopy, entityMap, domBuilder, errorHandler) {
 				}
 				if (!source.substring(start).match(/^\s*$/)) {
 					var doc = domBuilder.doc;
-					var text = doc.createTextNode(source.substr(start));
+					var text = doc.createTextNode(source.substring(start));
 					if (doc.documentElement) {
 						return errorHandler.error('Extra content at the end of the document');
 					}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xmldom/xmldom",
-	"version": "0.9.7",
+	"version": "0.9.9",
 	"description": "A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.",
 	"keywords": [
 		"w3c",
@@ -30,6 +30,7 @@
 	"scripts": {
 		"lint": "eslint examples lib test",
 		"format": "prettier --write examples lib test index.d.ts",
+		"format:check": "prettier --check examples lib test index.d.ts",
 		"changelog": "auto-changelog --unreleased-only",
 		"start": "nodemon --watch package.json --watch lib --watch test --exec 'npm --silent run test && npm --silent run lint'",
 		"test": "jest",
@@ -43,24 +44,21 @@
 		"node": ">=14.6"
 	},
 	"devDependencies": {
-		"@homer0/prettier-plugin-jsdoc": "9.1.0",
-		"@jazzer.js/core": "2.1.0",
-		"@jazzer.js/jest-runner": "2.1.0",
+		"@homer0/prettier-plugin-jsdoc": "10.0.0",
 		"auto-changelog": "2.5.0",
 		"eslint": "8.57.1",
-		"eslint-config-prettier": "10.0.1",
+		"eslint-config-prettier": "10.1.8",
 		"eslint-plugin-anti-trojan-source": "1.1.1",
 		"eslint-plugin-es5": "1.5.0",
-		"eslint-plugin-n": "17.15.1",
-		"eslint-plugin-prettier": "5.2.2",
+		"eslint-plugin-n": "17.21.3",
+		"eslint-plugin-prettier": "5.5.4",
 		"get-stream": "6.0.1",
 		"jest": "29.7.0",
-		"nodemon": "3.1.9",
+		"nodemon": "3.1.10",
 		"np": "8.0.4",
-		"prettier": "3.4.2",
-		"rxjs": "7.8.1",
+		"prettier": "3.6.2",
 		"xmltest": "2.0.3",
-		"yauzl": "3.2.0"
+		"yauzl": "3.2.1"
 	},
 	"bugs": {
 		"url": "https://github.com/xmldom/xmldom/issues"
@@ -71,5 +69,6 @@
 		"remote": "origin",
 		"tagPrefix": "",
 		"template": "./auto-changelog.hbs"
-	}
+	},
+	"packageManager": "npm@11.6.3+sha512.4085a763162e0e3acd19a4e9d23ad3aa0978e501ccf947dd7233c12a689ae0bb0190763c4ef12366990056b34eec438903ffed38fde4fbd722a17c2a7407ee92"
 }

package/readme.md

@@ -289,6 +289,13 @@ import { DOMParser } from '@xmldom/xmldom'
   - `isDefaultNamespace(namespaceURI)`
   - `lookupNamespaceURI(prefix)`
 
+### DOM Living Standard support:
+
+* [ParentNode](https://dom.spec.whatwg.org/#interface-parentnode) mixin (on `Document`, `DocumentFragment`, `Element`)
+
+  readonly attribute:
+  - `children`
+
 ### DOM extension by xmldom
 
 * [Node] Source position extension;