fast-xml-parser 4.2.1 → 4.2.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.
 
+**4.2.3 / 2023-06-05**
+* fix security bug
+
+**4.2.2 / 2023-04-18**
+* fix #562: fix unpaired tag when it comes in last of a nested tag. Also throw error when unpaired tag is used as closing tag
+
 **4.2.1 / 2023-04-18**
 * fix: jpath after unpaired tags
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-xml-parser",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
   "main": "./src/fxp.js",
   "scripts": {
@@ -58,10 +58,13 @@
     "webpack-cli": "^4.9.1"
   },
   "typings": "src/fxp.d.ts",
-  "funding": {
+  "funding": [{
     "type": "paypal",
     "url": "https://paypal.me/naturalintelligence"
-  },
+  },{
+    "type": "github",
+    "url": "https://github.com/sponsors/NaturalIntelligence"
+  }],
   "dependencies": {
     "strnum": "^1.0.5"
   }

package/src/xmlparser/DocTypeReader.js

@@ -19,7 +19,7 @@ function readDocType(xmlData, i){
                     i += 7; 
                     [entityName, val,i] = readEntityExp(xmlData,i+1);
                     if(val.indexOf("&") === -1) //Parameter entities are not supported
-                        entities[ entityName ] = {
+                        entities[ validateEntityName(entityName) ] = {
                             regx : RegExp( `&${entityName};`,"g"),
                             val: val
                         };
@@ -140,4 +140,16 @@ function isNotation(xmlData, i){
     return false
 }
 
+//an entity name should not contains special characters that may be used in regex
+//Eg !?\\\/[]$%{}^&*()<>
+const specialChar = "!?\\\/[]$%{}^&*()<>";
+
+function validateEntityName(name){
+    for (let i = 0; i < specialChar.length; i++) {
+        const ch = specialChar[i];
+        if(name.indexOf(ch) !== -1) throw new Error(`Invalid character ${ch} in entity name`);
+    }
+    return name;
+}
+
 module.exports = readDocType;

package/src/xmlparser/OrderedObjParser.js

@@ -208,10 +208,13 @@ const parseXml = function(xmlData) {
 
         //check if last tag of nested tag was unpaired tag
         const lastTagName = jPath.substring(jPath.lastIndexOf(".")+1);
+        if(tagName && this.options.unpairedTags.indexOf(tagName) !== -1 ){
+          throw new Error(`Unpaired tag can not be used as closing tag: </${tagName}>`);
+        }
         let propIndex = 0
         if(lastTagName && this.options.unpairedTags.indexOf(lastTagName) !== -1 ){
           propIndex = jPath.lastIndexOf('.', jPath.lastIndexOf('.')-1)
-          if(propIndex < 1) propIndex = jPath.lastIndexOf(".");
+          this.tagsNodeStack.pop();
         }else{
           propIndex = jPath.lastIndexOf(".");
         }