brepjs-bim 0.3.0 → 0.3.1

package/dist/bcf/bcfXml.d.ts

@@ -24,9 +24,15 @@ export interface XmlNode {
     readonly text: string;
 }
 /**
- * Parse an XML string into a tree. Tolerant of the XML declaration, comments,
- * whitespace, self-closing tags, and CDATA-free text. Throws on malformed
- * structure (unbalanced tags); callers wrap this in a `Result`.
+ * Parse an XML string into a tree. Tolerant of the XML declaration, processing
+ * instructions, comments, whitespace, self-closing tags, and CDATA-free text.
+ * Throws on malformed or unbalanced structure; callers wrap this in a `Result`.
+ *
+ * This is a hand-written cursor scan rather than a single tokenizing regex: the
+ * input is an untrusted `.bcfzip` payload, and a backtracking regex over
+ * uncontrolled data is a polynomial-ReDoS vector. Every construct here is
+ * consumed by an `indexOf` or a single-character advance, so the parse is linear
+ * in the input length. The sibling `ids/idsXml.ts` parser scans the same way.
  */
 export declare function parseXml(xml: string): XmlNode;
 export declare function findChild(node: XmlNode, tag: string): XmlNode | undefined;

package/dist/brepjs-bim.cjs

@@ -15979,24 +15979,24 @@ var XML_DECLARATION = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>";
 function xmlDocument(rootXml) {
 	return `${XML_DECLARATION}\n${rootXml}\n`;
 }
-function parseAttrs(raw) {
-	const attrs = {};
-	const attrRe = /([\w:.-]+)\s*=\s*"([^"]*)"/g;
-	let m;
-	while ((m = attrRe.exec(raw)) !== null) {
-		const key = m[1];
-		const val = m[2];
-		if (key !== void 0 && val !== void 0) attrs[key] = unescapeXml(val);
-	}
-	return attrs;
+function isNameChar(c) {
+	return /[\w:.-]/.test(c);
+}
+function isWhitespace(c) {
+	return /\s/.test(c);
 }
 /**
-* Parse an XML string into a tree. Tolerant of the XML declaration, comments,
-* whitespace, self-closing tags, and CDATA-free text. Throws on malformed
-* structure (unbalanced tags); callers wrap this in a `Result`.
+* Parse an XML string into a tree. Tolerant of the XML declaration, processing
+* instructions, comments, whitespace, self-closing tags, and CDATA-free text.
+* Throws on malformed or unbalanced structure; callers wrap this in a `Result`.
+*
+* This is a hand-written cursor scan rather than a single tokenizing regex: the
+* input is an untrusted `.bcfzip` payload, and a backtracking regex over
+* uncontrolled data is a polynomial-ReDoS vector. Every construct here is
+* consumed by an `indexOf` or a single-character advance, so the parse is linear
+* in the input length. The sibling `ids/idsXml.ts` parser scans the same way.
 */
 function parseXml(xml) {
-	const tokenRe = /<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<\/([\w:.-]+)\s*>|<([\w:.-]+)((?:\s+[\w:.-]+\s*=\s*"[^"]*")*)\s*(\/?)>|([^<]+)/g;
 	const root = {
 		tag: "#root",
 		attrs: {},
@@ -16004,36 +16004,84 @@ function parseXml(xml) {
 		text: ""
 	};
 	const stack = [root];
-	let m;
-	while ((m = tokenRe.exec(xml)) !== null) {
-		const [full, closeTag, openTag, attrsRaw, selfClose, textRun] = m;
-		if (full.startsWith("<!--") || full.startsWith("<?")) continue;
-		if (closeTag !== void 0) {
-			const top = stack[stack.length - 1];
-			if (top === void 0 || top.tag !== closeTag) throw new Error(`Unbalanced XML: unexpected </${closeTag}>`);
-			stack.pop();
-			continue;
-		}
-		if (openTag !== void 0) {
-			const node = {
-				tag: openTag,
-				attrs: parseAttrs(attrsRaw ?? ""),
-				children: [],
-				text: ""
-			};
-			const parent = stack[stack.length - 1];
-			if (parent === void 0) throw new Error("Unbalanced XML: empty stack");
-			parent.children.push(node);
-			if (selfClose !== "/") stack.push(node);
-			continue;
+	const len = xml.length;
+	let i = 0;
+	const fail = (msg) => {
+		throw new Error(`Malformed XML: ${msg} at offset ${String(i)}`);
+	};
+	const skipWhitespace = () => {
+		while (i < len && isWhitespace(xml.charAt(i))) i += 1;
+	};
+	const readName = () => {
+		const start = i;
+		while (i < len && isNameChar(xml.charAt(i))) i += 1;
+		return xml.slice(start, i);
+	};
+	const readAttrs = () => {
+		const attrs = {};
+		for (;;) {
+			skipWhitespace();
+			const c = xml.charAt(i);
+			if (i >= len || c === ">" || c === "/") return attrs;
+			const name = readName();
+			if (name.length === 0) fail("expected attribute name");
+			skipWhitespace();
+			if (xml.charAt(i) !== "=") fail(`expected '=' after attribute "${name}"`);
+			i += 1;
+			skipWhitespace();
+			if (xml.charAt(i) !== "\"") fail(`expected '"' opening attribute "${name}"`);
+			i += 1;
+			const end = xml.indexOf("\"", i);
+			if (end === -1) fail(`unterminated value for attribute "${name}"`);
+			attrs[name] = unescapeXml(xml.slice(i, end));
+			i = end + 1;
 		}
-		if (textRun !== void 0) {
-			const decoded = unescapeXml(textRun);
-			if (decoded.trim().length > 0) {
-				const top = stack[stack.length - 1];
-				if (top !== void 0) top.text += decoded;
-			}
+	};
+	while (i < len) if (xml.startsWith("<!--", i)) {
+		const end = xml.indexOf("-->", i + 4);
+		if (end === -1) fail("unterminated comment");
+		i = end + 3;
+	} else if (xml.startsWith("<?", i)) {
+		const end = xml.indexOf("?>", i + 2);
+		if (end === -1) fail("unterminated processing instruction");
+		i = end + 2;
+	} else if (xml.startsWith("</", i)) {
+		i += 2;
+		const name = readName();
+		skipWhitespace();
+		if (xml.charAt(i) !== ">") fail(`expected '>' closing </${name}>`);
+		i += 1;
+		const top = stack[stack.length - 1];
+		if (top === void 0 || top.tag !== name) throw new Error(`Unbalanced XML: unexpected </${name}>`);
+		stack.pop();
+	} else if (xml.charAt(i) === "<") {
+		i += 1;
+		const tag = readName();
+		if (tag.length === 0) fail("expected element name");
+		const node = {
+			tag,
+			attrs: readAttrs(),
+			children: [],
+			text: ""
+		};
+		const parent = stack[stack.length - 1];
+		if (parent === void 0) throw new Error("Unbalanced XML: empty stack");
+		parent.children.push(node);
+		skipWhitespace();
+		if (xml.startsWith("/>", i)) i += 2;
+		else if (xml.charAt(i) === ">") {
+			i += 1;
+			stack.push(node);
+		} else fail(`expected '>' in <${tag}>`);
+	} else {
+		const next = xml.indexOf("<", i);
+		const end = next === -1 ? len : next;
+		const decoded = unescapeXml(xml.slice(i, end));
+		if (decoded.trim().length > 0) {
+			const top = stack[stack.length - 1];
+			if (top !== void 0) top.text += decoded;
 		}
+		i = end;
 	}
 	if (stack.length !== 1) throw new Error("Unbalanced XML: unclosed elements remain");
 	const top = root.children[0];

package/dist/brepjs-bim.js

@@ -15956,24 +15956,24 @@ var XML_DECLARATION = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>";
 function xmlDocument(rootXml) {
 	return `${XML_DECLARATION}\n${rootXml}\n`;
 }
-function parseAttrs(raw) {
-	const attrs = {};
-	const attrRe = /([\w:.-]+)\s*=\s*"([^"]*)"/g;
-	let m;
-	while ((m = attrRe.exec(raw)) !== null) {
-		const key = m[1];
-		const val = m[2];
-		if (key !== void 0 && val !== void 0) attrs[key] = unescapeXml(val);
-	}
-	return attrs;
+function isNameChar(c) {
+	return /[\w:.-]/.test(c);
+}
+function isWhitespace(c) {
+	return /\s/.test(c);
 }
 /**
-* Parse an XML string into a tree. Tolerant of the XML declaration, comments,
-* whitespace, self-closing tags, and CDATA-free text. Throws on malformed
-* structure (unbalanced tags); callers wrap this in a `Result`.
+* Parse an XML string into a tree. Tolerant of the XML declaration, processing
+* instructions, comments, whitespace, self-closing tags, and CDATA-free text.
+* Throws on malformed or unbalanced structure; callers wrap this in a `Result`.
+*
+* This is a hand-written cursor scan rather than a single tokenizing regex: the
+* input is an untrusted `.bcfzip` payload, and a backtracking regex over
+* uncontrolled data is a polynomial-ReDoS vector. Every construct here is
+* consumed by an `indexOf` or a single-character advance, so the parse is linear
+* in the input length. The sibling `ids/idsXml.ts` parser scans the same way.
 */
 function parseXml(xml) {
-	const tokenRe = /<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<\/([\w:.-]+)\s*>|<([\w:.-]+)((?:\s+[\w:.-]+\s*=\s*"[^"]*")*)\s*(\/?)>|([^<]+)/g;
 	const root = {
 		tag: "#root",
 		attrs: {},
@@ -15981,36 +15981,84 @@ function parseXml(xml) {
 		text: ""
 	};
 	const stack = [root];
-	let m;
-	while ((m = tokenRe.exec(xml)) !== null) {
-		const [full, closeTag, openTag, attrsRaw, selfClose, textRun] = m;
-		if (full.startsWith("<!--") || full.startsWith("<?")) continue;
-		if (closeTag !== void 0) {
-			const top = stack[stack.length - 1];
-			if (top === void 0 || top.tag !== closeTag) throw new Error(`Unbalanced XML: unexpected </${closeTag}>`);
-			stack.pop();
-			continue;
-		}
-		if (openTag !== void 0) {
-			const node = {
-				tag: openTag,
-				attrs: parseAttrs(attrsRaw ?? ""),
-				children: [],
-				text: ""
-			};
-			const parent = stack[stack.length - 1];
-			if (parent === void 0) throw new Error("Unbalanced XML: empty stack");
-			parent.children.push(node);
-			if (selfClose !== "/") stack.push(node);
-			continue;
+	const len = xml.length;
+	let i = 0;
+	const fail = (msg) => {
+		throw new Error(`Malformed XML: ${msg} at offset ${String(i)}`);
+	};
+	const skipWhitespace = () => {
+		while (i < len && isWhitespace(xml.charAt(i))) i += 1;
+	};
+	const readName = () => {
+		const start = i;
+		while (i < len && isNameChar(xml.charAt(i))) i += 1;
+		return xml.slice(start, i);
+	};
+	const readAttrs = () => {
+		const attrs = {};
+		for (;;) {
+			skipWhitespace();
+			const c = xml.charAt(i);
+			if (i >= len || c === ">" || c === "/") return attrs;
+			const name = readName();
+			if (name.length === 0) fail("expected attribute name");
+			skipWhitespace();
+			if (xml.charAt(i) !== "=") fail(`expected '=' after attribute "${name}"`);
+			i += 1;
+			skipWhitespace();
+			if (xml.charAt(i) !== "\"") fail(`expected '"' opening attribute "${name}"`);
+			i += 1;
+			const end = xml.indexOf("\"", i);
+			if (end === -1) fail(`unterminated value for attribute "${name}"`);
+			attrs[name] = unescapeXml(xml.slice(i, end));
+			i = end + 1;
 		}
-		if (textRun !== void 0) {
-			const decoded = unescapeXml(textRun);
-			if (decoded.trim().length > 0) {
-				const top = stack[stack.length - 1];
-				if (top !== void 0) top.text += decoded;
-			}
+	};
+	while (i < len) if (xml.startsWith("<!--", i)) {
+		const end = xml.indexOf("-->", i + 4);
+		if (end === -1) fail("unterminated comment");
+		i = end + 3;
+	} else if (xml.startsWith("<?", i)) {
+		const end = xml.indexOf("?>", i + 2);
+		if (end === -1) fail("unterminated processing instruction");
+		i = end + 2;
+	} else if (xml.startsWith("</", i)) {
+		i += 2;
+		const name = readName();
+		skipWhitespace();
+		if (xml.charAt(i) !== ">") fail(`expected '>' closing </${name}>`);
+		i += 1;
+		const top = stack[stack.length - 1];
+		if (top === void 0 || top.tag !== name) throw new Error(`Unbalanced XML: unexpected </${name}>`);
+		stack.pop();
+	} else if (xml.charAt(i) === "<") {
+		i += 1;
+		const tag = readName();
+		if (tag.length === 0) fail("expected element name");
+		const node = {
+			tag,
+			attrs: readAttrs(),
+			children: [],
+			text: ""
+		};
+		const parent = stack[stack.length - 1];
+		if (parent === void 0) throw new Error("Unbalanced XML: empty stack");
+		parent.children.push(node);
+		skipWhitespace();
+		if (xml.startsWith("/>", i)) i += 2;
+		else if (xml.charAt(i) === ">") {
+			i += 1;
+			stack.push(node);
+		} else fail(`expected '>' in <${tag}>`);
+	} else {
+		const next = xml.indexOf("<", i);
+		const end = next === -1 ? len : next;
+		const decoded = unescapeXml(xml.slice(i, end));
+		if (decoded.trim().length > 0) {
+			const top = stack[stack.length - 1];
+			if (top !== void 0) top.text += decoded;
 		}
+		i = end;
 	}
 	if (stack.length !== 1) throw new Error("Unbalanced XML: unclosed elements remain");
 	const top = root.children[0];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brepjs-bim",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "BIM layer for brepjs — IFC4-aligned parametric building elements",
   "keywords": [
     "bim",