fast-xml-parser 5.5.8 → 5.5.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-xml-parser",
-  "version": "5.5.8",
+  "version": "5.5.10",
   "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
   "main": "./lib/fxp.cjs",
   "type": "module",
@@ -88,7 +88,7 @@
   ],
   "dependencies": {
     "fast-xml-builder": "^1.1.4",
-    "path-expression-matcher": "^1.2.0",
-    "strnum": "^2.2.0"
+    "path-expression-matcher": "^1.2.1",
+    "strnum": "^2.2.2"
   }
 }

package/src/fxp.d.ts

@@ -1,4 +1,144 @@
-import type { Expression, ReadonlyMatcher } from './pem';
+/**
+ * Types copied from path-expression-matcher
+ * @version <version>
+ * @updated <date>
+ *
+ * Update this file when path-expression-matcher releases a new version.
+ * Source: https://github.com/NaturalIntelligence/path-expression-matcher
+ */
+
+/**
+ * Options for creating an Expression
+ */
+export interface ExpressionOptions {
+  /**
+   * Path separator character
+   * @default '.'
+   */
+  separator?: string;
+}
+
+/**
+ * Parsed segment from an expression pattern
+ */
+export interface Segment {
+  type: 'tag' | 'deep-wildcard';
+  tag?: string;
+  namespace?: string;
+  attrName?: string;
+  attrValue?: string;
+  position?: 'first' | 'last' | 'odd' | 'even' | 'nth';
+  positionValue?: number;
+}
+
+/**
+ * Expression - Parses and stores a tag pattern expression.
+ * Patterns are parsed once and stored in an optimized structure for fast matching.
+ * 
+ * @example
+ * ```typescript
+ * const expr = new Expression("root.users.user");
+ * const expr2 = new Expression("..user[id]:first");
+ * const expr3 = new Expression("root/users/user", { separator: '/' });
+ * ```
+ * 
+ * Pattern Syntax:
+ * - `root.users.user`      — Match exact path
+ * - `..user`               — Match "user" at any depth (deep wildcard)
+ * - `user[id]`             — Match user tag with "id" attribute
+ * - `user[id=123]`         — Match user tag where id="123"
+ * - `user:first`           — Match first occurrence of user tag
+ * - `ns::user`             — Match user tag with namespace "ns"
+ * - `ns::user[id]:first`   — Combine namespace, attribute, and position
+ */
+export class Expression {
+  readonly pattern: string;
+  readonly separator: string;
+  readonly segments: Segment[];
+
+  constructor(pattern: string, options?: ExpressionOptions);
+
+  get length(): number;
+  hasDeepWildcard(): boolean;
+  hasAttributeCondition(): boolean;
+  hasPositionSelector(): boolean;
+  toString(): string;
+}
+
+// ---------------------------------------------------------------------------
+// ReadonlyMatcher
+// ---------------------------------------------------------------------------
+
+/**
+ * A live read-only view of a Matcher instance, returned by Matcher.readOnly.
+ *
+ * All query and inspection methods work normally and always reflect the current
+ * state of the underlying matcher. State-mutating methods (`push`, `pop`,
+ * `reset`, `updateCurrent`, `restore`) are not present — calling them on the
+ * underlying Proxy throws a `TypeError` at runtime.
+ *
+ * This is the type received by all FXP user callbacks when `jPath: false`.
+ */
+export interface ReadonlyMatcher {
+  readonly separator: string;
+
+  /** Check if current path matches an Expression. */
+  matches(expression: Expression): boolean;
+
+  /** Get current tag name, or `undefined` if path is empty. */
+  getCurrentTag(): string | undefined;
+
+  /** Get current namespace, or `undefined` if not present. */
+  getCurrentNamespace(): string | undefined;
+
+  /** Get attribute value of the current node. */
+  getAttrValue(attrName: string): any;
+
+  /** Check if the current node has a given attribute. */
+  hasAttr(attrName: string): boolean;
+
+  /** Sibling position of the current node (child index in parent). */
+  getPosition(): number;
+
+  /** Occurrence counter of the current tag name at this level. */
+  getCounter(): number;
+
+  /** Number of nodes in the current path. */
+  getDepth(): number;
+
+  /** Current path as a string (e.g. `"root.users.user"`). */
+  toString(separator?: string, includeNamespace?: boolean): string;
+
+  /** Current path as an array of tag names. */
+  toArray(): string[];
+
+  /**
+   * Create a snapshot of the current state.
+   * The snapshot can be passed to the real Matcher.restore if needed.
+   */
+  snapshot(): MatcherSnapshot;
+}
+
+/** Internal node structure — exposed via snapshot only. */
+export interface PathNode {
+  tag: string;
+  namespace?: string;
+  position: number;
+  counter: number;
+  values?: Record<string, any>;
+}
+
+/** Snapshot of matcher state returned by `snapshot()` and `readOnly().snapshot()`. */
+export interface MatcherSnapshot {
+  path: PathNode[];
+  siblingStacks: Map<string, number>[];
+}
+
+/**********************************************************************
+ * 
+ * END of path-expression-matcher relevant typings
+ * 
+ **********************************************************************/
 
 // jPath: true  → string
 // jPath: false → ReadonlyMatcher

package/src/xmlparser/OptionsBuilder.js

@@ -105,10 +105,10 @@ function normalizeProcessEntities(value) {
     return {
       enabled: value.enabled !== false,
       maxEntitySize: Math.max(1, value.maxEntitySize ?? 10000),
-      maxExpansionDepth: Math.max(1, value.maxExpansionDepth ?? 10),
-      maxTotalExpansions: Math.max(1, value.maxTotalExpansions ?? 1000),
+      maxExpansionDepth: Math.max(1, value.maxExpansionDepth ?? 10000),
+      maxTotalExpansions: Math.max(1, value.maxTotalExpansions ?? Infinity),
       maxExpandedLength: Math.max(1, value.maxExpandedLength ?? 100000),
-      maxEntityCount: Math.max(1, value.maxEntityCount ?? 100),
+      maxEntityCount: Math.max(1, value.maxEntityCount ?? 1000),
       allowedTags: value.allowedTags ?? null,
       tagFilter: value.tagFilter ?? null
     };

package/src/xmlparser/OrderedObjParser.js

@@ -217,89 +217,80 @@ function buildAttributesMap(attrStr, jPath, tagName) {
     const len = matches.length; //don't make it inline
     const attrs = {};
 
-    // First pass: parse all attributes and update matcher with raw values
-    // This ensures the matcher has all attribute values when processors run
+    // Pre-process values once: trim + entity replacement
+    // Reused in both matcher update and second pass
+    const processedVals = new Array(len);
+    let hasRawAttrs = false;
     const rawAttrsForMatcher = {};
+
     for (let i = 0; i < len; i++) {
       const attrName = this.resolveNameSpace(matches[i][1]);
       const oldVal = matches[i][4];
 
       if (attrName.length && oldVal !== undefined) {
-        let parsedVal = oldVal;
-        if (this.options.trimValues) {
-          parsedVal = parsedVal.trim();
-        }
-        parsedVal = this.replaceEntitiesValue(parsedVal, tagName, this.readonlyMatcher);
-        rawAttrsForMatcher[attrName] = parsedVal;
+        let val = oldVal;
+        if (this.options.trimValues) val = val.trim();
+        val = this.replaceEntitiesValue(val, tagName, this.readonlyMatcher);
+        processedVals[i] = val;
+
+        rawAttrsForMatcher[attrName] = val;
+        hasRawAttrs = true;
       }
     }
 
-    // Update matcher with raw attribute values BEFORE running processors
-    if (Object.keys(rawAttrsForMatcher).length > 0 && typeof jPath === 'object' && jPath.updateCurrent) {
+    // Update matcher ONCE before second pass, if applicable
+    if (hasRawAttrs && typeof jPath === 'object' && jPath.updateCurrent) {
       jPath.updateCurrent(rawAttrsForMatcher);
     }
 
-    // Second pass: now process attributes with matcher having full attribute context
+    // Hoist toString() once — path doesn't change during attribute processing
+    const jPathStr = this.options.jPath ? jPath.toString() : this.readonlyMatcher;
+
+    // Second pass: apply processors, build final attrs
+    let hasAttrs = false;
     for (let i = 0; i < len; i++) {
       const attrName = this.resolveNameSpace(matches[i][1]);
 
-      // Convert jPath to string if needed for ignoreAttributesFn
-      const jPathStr = this.options.jPath ? jPath.toString() : this.readonlyMatcher;
-      if (this.ignoreAttributesFn(attrName, jPathStr)) {
-        continue
-      }
+      if (this.ignoreAttributesFn(attrName, jPathStr)) continue;
 
-      let oldVal = matches[i][4];
       let aName = this.options.attributeNamePrefix + attrName;
 
       if (attrName.length) {
         if (this.options.transformAttributeName) {
           aName = this.options.transformAttributeName(aName);
         }
-        //if (aName === "__proto__") aName = "#__proto__";
         aName = sanitizeName(aName, this.options);
 
-        if (oldVal !== undefined) {
-          if (this.options.trimValues) {
-            oldVal = oldVal.trim();
-          }
-          oldVal = this.replaceEntitiesValue(oldVal, tagName, this.readonlyMatcher);
+        if (matches[i][4] !== undefined) {
+          // Reuse already-processed value — no double entity replacement
+          const oldVal = processedVals[i];
 
-          // Pass jPath string or readonlyMatcher based on options.jPath setting
-          const jPathOrMatcher = this.options.jPath ? jPath.toString() : this.readonlyMatcher;
-          const newVal = this.options.attributeValueProcessor(attrName, oldVal, jPathOrMatcher);
+          const newVal = this.options.attributeValueProcessor(attrName, oldVal, jPathStr);
           if (newVal === null || newVal === undefined) {
-            //don't parse
             attrs[aName] = oldVal;
           } else if (typeof newVal !== typeof oldVal || newVal !== oldVal) {
-            //overwrite
             attrs[aName] = newVal;
           } else {
-            //parse
-            attrs[aName] = parseValue(
-              oldVal,
-              this.options.parseAttributeValue,
-              this.options.numberParseOptions
-            );
+            attrs[aName] = parseValue(oldVal, this.options.parseAttributeValue, this.options.numberParseOptions);
           }
+          hasAttrs = true;
         } else if (this.options.allowBooleanAttributes) {
           attrs[aName] = true;
+          hasAttrs = true;
         }
       }
     }
 
-    if (!Object.keys(attrs).length) {
-      return;
-    }
+    if (!hasAttrs) return;
+
     if (this.options.attributesGroupName) {
       const attrCollection = {};
       attrCollection[this.options.attributesGroupName] = attrs;
       return attrCollection;
     }
-    return attrs
+    return attrs;
   }
 }
-
 const parseXml = function (xmlData) {
   xmlData = xmlData.replace(/\r\n?/g, "\n"); //TODO: remove this line
   const xmlObj = new xmlNode('!xml');
@@ -659,6 +650,7 @@ function replaceEntitiesValue(val, tagName, jPath) {
       }
     }
   }
+  if (val.indexOf('&') === -1) return val;
   // Replace standard entities
   for (const entityName of Object.keys(this.lastEntities)) {
     const entity = this.lastEntities[entityName];

package/lib/pem.d.cts

@@ -1,148 +0,0 @@
-/**
- * Types copied from path-expression-matcher
- * @version <version>
- * @updated <date>
- *
- * Update this file when path-expression-matcher releases a new version.
- * Source: https://github.com/NaturalIntelligence/path-expression-matcher
- */
-
-/**
- * Options for creating an Expression
- */
-interface ExpressionOptions {
-  /**
-   * Path separator character
-   * @default '.'
-   */
-  separator?: string;
-}
-
-/**
- * Parsed segment from an expression pattern
- */
-interface Segment {
-  type: 'tag' | 'deep-wildcard';
-  tag?: string;
-  namespace?: string;
-  attrName?: string;
-  attrValue?: string;
-  position?: 'first' | 'last' | 'odd' | 'even' | 'nth';
-  positionValue?: number;
-}
-
-/**
- * Expression - Parses and stores a tag pattern expression.
- * Patterns are parsed once and stored in an optimized structure for fast matching.
- *
- * @example
- * ```typescript
- * const expr = new Expression("root.users.user");
- * const expr2 = new Expression("..user[id]:first");
- * const expr3 = new Expression("root/users/user", { separator: '/' });
- * ```
- *
- * Pattern Syntax:
- * - `root.users.user`      — Match exact path
- * - `..user`               — Match "user" at any depth (deep wildcard)
- * - `user[id]`             — Match user tag with "id" attribute
- * - `user[id=123]`         — Match user tag where id="123"
- * - `user:first`           — Match first occurrence of user tag
- * - `ns::user`             — Match user tag with namespace "ns"
- * - `ns::user[id]:first`   — Combine namespace, attribute, and position
- */
-declare class Expression {
-  readonly pattern: string;
-  readonly separator: string;
-  readonly segments: Segment[];
-
-  constructor(pattern: string, options?: ExpressionOptions);
-
-  get length(): number;
-  hasDeepWildcard(): boolean;
-  hasAttributeCondition(): boolean;
-  hasPositionSelector(): boolean;
-  toString(): string;
-}
-
-// ---------------------------------------------------------------------------
-// ReadonlyMatcher
-// ---------------------------------------------------------------------------
-
-/**
- * A live read-only view of a Matcher instance, returned by Matcher.readOnly().
- *
- * All query and inspection methods work normally and always reflect the current
- * state of the underlying matcher. State-mutating methods (`push`, `pop`,
- * `reset`, `updateCurrent`, `restore`) are not present — calling them on the
- * underlying Proxy throws a `TypeError` at runtime.
- *
- * This is the type received by all FXP user callbacks when `jPath: false`.
- */
-interface ReadonlyMatcher {
-  readonly separator: string;
-
-  /** Check if current path matches an Expression. */
-  matches(expression: Expression): boolean;
-
-  /** Get current tag name, or `undefined` if path is empty. */
-  getCurrentTag(): string | undefined;
-
-  /** Get current namespace, or `undefined` if not present. */
-  getCurrentNamespace(): string | undefined;
-
-  /** Get attribute value of the current node. */
-  getAttrValue(attrName: string): any;
-
-  /** Check if the current node has a given attribute. */
-  hasAttr(attrName: string): boolean;
-
-  /** Sibling position of the current node (child index in parent). */
-  getPosition(): number;
-
-  /** Occurrence counter of the current tag name at this level. */
-  getCounter(): number;
-
-  /** Number of nodes in the current path. */
-  getDepth(): number;
-
-  /** Current path as a string (e.g. `"root.users.user"`). */
-  toString(separator?: string, includeNamespace?: boolean): string;
-
-  /** Current path as an array of tag names. */
-  toArray(): string[];
-
-  /**
-   * Create a snapshot of the current state.
-   * The snapshot can be passed to the real Matcher.restore() if needed.
-   */
-  snapshot(): MatcherSnapshot;
-}
-
-/** Internal node structure — exposed via snapshot only. */
-interface PathNode {
-  tag: string;
-  namespace?: string;
-  position: number;
-  counter: number;
-  values?: Record<string, any>;
-}
-
-/** Snapshot of matcher state returned by `snapshot()` and `readOnly().snapshot()`. */
-interface MatcherSnapshot {
-  path: PathNode[];
-  siblingStacks: Map<string, number>[];
-}
-
-declare namespace pem {
-  export {
-    Expression,
-    ExpressionOptions,
-    Segment,
-    ReadonlyMatcher,
-    PathNode,
-    MatcherSnapshot,
-  }
-}
-
-export = pem;

package/src/pem.d.ts

@@ -1,135 +0,0 @@
-/**
- * Types copied from path-expression-matcher
- * @version <version>
- * @updated <date>
- *
- * Update this file when path-expression-matcher releases a new version.
- * Source: https://github.com/NaturalIntelligence/path-expression-matcher
- */
-
-/**
- * Options for creating an Expression
- */
-export interface ExpressionOptions {
-  /**
-   * Path separator character
-   * @default '.'
-   */
-  separator?: string;
-}
-
-/**
- * Parsed segment from an expression pattern
- */
-export interface Segment {
-  type: 'tag' | 'deep-wildcard';
-  tag?: string;
-  namespace?: string;
-  attrName?: string;
-  attrValue?: string;
-  position?: 'first' | 'last' | 'odd' | 'even' | 'nth';
-  positionValue?: number;
-}
-
-/**
- * Expression - Parses and stores a tag pattern expression.
- * Patterns are parsed once and stored in an optimized structure for fast matching.
- * 
- * @example
- * ```typescript
- * const expr = new Expression("root.users.user");
- * const expr2 = new Expression("..user[id]:first");
- * const expr3 = new Expression("root/users/user", { separator: '/' });
- * ```
- * 
- * Pattern Syntax:
- * - `root.users.user`      — Match exact path
- * - `..user`               — Match "user" at any depth (deep wildcard)
- * - `user[id]`             — Match user tag with "id" attribute
- * - `user[id=123]`         — Match user tag where id="123"
- * - `user:first`           — Match first occurrence of user tag
- * - `ns::user`             — Match user tag with namespace "ns"
- * - `ns::user[id]:first`   — Combine namespace, attribute, and position
- */
-export class Expression {
-  readonly pattern: string;
-  readonly separator: string;
-  readonly segments: Segment[];
-
-  constructor(pattern: string, options?: ExpressionOptions);
-
-  get length(): number;
-  hasDeepWildcard(): boolean;
-  hasAttributeCondition(): boolean;
-  hasPositionSelector(): boolean;
-  toString(): string;
-}
-
-// ---------------------------------------------------------------------------
-// ReadonlyMatcher
-// ---------------------------------------------------------------------------
-
-/**
- * A live read-only view of a {@link Matcher} instance, returned by {@link Matcher.readOnly}.
- *
- * All query and inspection methods work normally and always reflect the current
- * state of the underlying matcher. State-mutating methods (`push`, `pop`,
- * `reset`, `updateCurrent`, `restore`) are not present — calling them on the
- * underlying Proxy throws a `TypeError` at runtime.
- *
- * This is the type received by all FXP user callbacks when `jPath: false`.
- */
-export interface ReadonlyMatcher {
-  readonly separator: string;
-
-  /** Check if current path matches an Expression. */
-  matches(expression: Expression): boolean;
-
-  /** Get current tag name, or `undefined` if path is empty. */
-  getCurrentTag(): string | undefined;
-
-  /** Get current namespace, or `undefined` if not present. */
-  getCurrentNamespace(): string | undefined;
-
-  /** Get attribute value of the current node. */
-  getAttrValue(attrName: string): any;
-
-  /** Check if the current node has a given attribute. */
-  hasAttr(attrName: string): boolean;
-
-  /** Sibling position of the current node (child index in parent). */
-  getPosition(): number;
-
-  /** Occurrence counter of the current tag name at this level. */
-  getCounter(): number;
-
-  /** Number of nodes in the current path. */
-  getDepth(): number;
-
-  /** Current path as a string (e.g. `"root.users.user"`). */
-  toString(separator?: string, includeNamespace?: boolean): string;
-
-  /** Current path as an array of tag names. */
-  toArray(): string[];
-
-  /**
-   * Create a snapshot of the current state.
-   * The snapshot can be passed to the real {@link Matcher.restore} if needed.
-   */
-  snapshot(): MatcherSnapshot;
-}
-
-/** Internal node structure — exposed via snapshot only. */
-export interface PathNode {
-  tag: string;
-  namespace?: string;
-  position: number;
-  counter: number;
-  values?: Record<string, any>;
-}
-
-/** Snapshot of matcher state returned by `snapshot()` and `readOnly().snapshot()`. */
-export interface MatcherSnapshot {
-  path: PathNode[];
-  siblingStacks: Map<string, number>[];
-}