fast-xml-validator 1.0.0

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "fast-xml-validator",
+  "version": "1.0.0",
+  "description": "Validate XML for Syntax and Business rules without C/C++ based libraries",
+  "main": "./lib/fxv.cjs",
+  "type": "module",
+  "sideEffects": false,
+  "module": "./src/fxv.js",
+  "types": "./src/fxv.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./src/fxv.d.ts",
+        "default": "./src/fxv.js"
+      },
+      "require": {
+        "types": "./lib/fxv.d.cts",
+        "default": "./lib/fxv.cjs"
+      }
+    }
+  },
+  "scripts": {
+    "test": "c8 --reporter=lcov --reporter=text jasmine specs/*spec.js",
+    "bundle": "webpack --config webpack.cjs.config.js"
+  },
+  "files": [
+    "lib",
+    "src",
+    "CHANGELOG.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NaturalIntelligence/fast-xml-validator.git"
+  },
+  "keywords": [
+    "fast",
+    "xml",
+    "validator",
+    "validate",
+    "syntax",
+    "rules",
+    "business",
+    "schema"
+  ],
+  "author": "Amit Gupta (https://solothought.com)",
+  "license": "MIT",
+  "devDependencies": {
+    "@babel/core": "^7.13.10",
+    "@babel/plugin-transform-runtime": "^7.13.10",
+    "@babel/preset-env": "^7.13.10",
+    "@babel/register": "^7.13.8",
+    "@types/node": "20",
+    "babel-loader": "^8.2.2",
+    "c8": "^10.1.3",
+    "eslint": "^8.3.0",
+    "jasmine": "^5.6.0",
+    "typescript": "5",
+    "webpack": "^5.64.4",
+    "webpack-cli": "^4.9.1"
+  },
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/NaturalIntelligence"
+    }
+  ],
+  "dependencies": {
+    "detailed-xml-validator": "^2.1.0"
+  }
+}

package/src/DocTypeValidator.js

@@ -0,0 +1,279 @@
+import { isName } from './util.js';
+
+const defaultOptions = {
+    maxEntityCount: Infinity,
+    maxEntitySize: Infinity,
+};
+
+export default class DocTypeValidator {
+    constructor(options) {
+        this.options = Object.assign({}, defaultOptions, options);
+        this.suppressValidationErr = !options;
+    }
+
+    validateDocType(xmlData, i) {
+        if (
+            xmlData[i + 3] !== 'O' ||
+            xmlData[i + 4] !== 'C' ||
+            xmlData[i + 5] !== 'T' ||
+            xmlData[i + 6] !== 'Y' ||
+            xmlData[i + 7] !== 'P' ||
+            xmlData[i + 8] !== 'E'
+        ) {
+            throw new Error(`Invalid Tag instead of DOCTYPE`);
+        }
+
+        i += 9;
+        let angleBracketsCount = 1;
+        let hasBody = false;
+        let comment = false;
+        let entityCount = 0;
+
+        for (; i < xmlData.length; i++) {
+            if (xmlData[i] === '<' && !comment) {
+                if (hasBody && hasSeq(xmlData, '!ENTITY', i)) {
+                    i += 7;
+                    [entityCount, i] = this._validateEntityExp(xmlData, i + 1, entityCount);
+                    // continue;
+                } else if (hasBody && hasSeq(xmlData, '!ELEMENT', i)) {
+                    i += 8;
+                    i = this._validateElementExp(xmlData, i + 1);
+                    // continue;
+                } else if (hasBody && hasSeq(xmlData, '!ATTLIST', i)) {
+                    i += 8;
+                    i = this._validateAttlistExp(xmlData, i + 1);
+                    continue;
+                } else if (hasBody && hasSeq(xmlData, '!NOTATION', i)) {
+                    i += 9;
+                    i = this._validateNotationExp(xmlData, i + 1);
+                    // continue;
+                } else if (hasSeq(xmlData, '!--', i)) {
+                    comment = true;
+                } else {
+                    throw new Error(`Invalid DOCTYPE`);
+                }
+                angleBracketsCount++;
+            } else if (xmlData[i] === '>') {
+                if (comment) {
+                    if (xmlData[i - 1] === '-' && xmlData[i - 2] === '-') {
+                        comment = false;
+                        angleBracketsCount--;
+                    }
+                } else {
+                    angleBracketsCount--;
+                }
+                if (angleBracketsCount === 0) break;
+            } else if (xmlData[i] === '[') {
+                hasBody = true;
+            }
+        }
+
+        if (angleBracketsCount !== 0) {
+            throw new Error(`Unclosed DOCTYPE`);
+        }
+
+        return i;
+    }
+
+    _validateEntityExp(xmlData, i, entityCount) {
+        i = skipWhitespace(xmlData, i);
+
+        // Read and validate entity name
+        const nameStart = i;
+        while (i < xmlData.length && !/\s/.test(xmlData[i]) && xmlData[i] !== '"' && xmlData[i] !== "'") {
+            i++;
+        }
+        const entityName = xmlData.substring(nameStart, i);
+        validateName(entityName);
+
+        i = skipWhitespace(xmlData, i);
+
+        // Check for unsupported constructs
+        if (!this.suppressValidationErr) {
+            if (xmlData.substring(i, i + 6).toUpperCase() === 'SYSTEM') {
+                throw new Error('External entities are not supported');
+            } else if (xmlData[i] === '%') {
+                throw new Error('Parameter entities are not supported');
+            }
+        }
+
+        // Read and validate the entity value (validates quoting + size limit)
+        let entityValue;
+        [i, entityValue] = readQuotedValue(xmlData, i, 'entity');
+
+        const { maxEntitySize, maxEntityCount } = this.options;
+
+        if (entityValue.length > maxEntitySize) {
+            throw new Error(
+                `Entity "${entityName}" size (${entityValue.length}) exceeds maximum allowed size (${maxEntitySize})`
+            );
+        }
+
+        // Only count non-parameter entities (parameter entities contain '&')
+        if (entityValue.indexOf('&') === -1) {
+            entityCount++;
+            if (entityCount > maxEntityCount) {
+                throw new Error(
+                    `Entity count (${entityCount}) exceeds maximum allowed (${maxEntityCount})`
+                );
+            }
+        }
+
+        return [entityCount, i - 1];
+    }
+
+    _validateNotationExp(xmlData, i) {
+        i = skipWhitespace(xmlData, i);
+
+        // Read and validate notation name
+        const nameStart = i;
+        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
+        const notationName = xmlData.substring(nameStart, i);
+        !this.suppressValidationErr && validateName(notationName);
+
+        i = skipWhitespace(xmlData, i);
+
+        const identifierType = xmlData.substring(i, i + 6).toUpperCase();
+        if (!this.suppressValidationErr && identifierType !== 'SYSTEM' && identifierType !== 'PUBLIC') {
+            throw new Error(`Expected SYSTEM or PUBLIC, found "${identifierType}"`);
+        }
+        i += identifierType.length;
+        i = skipWhitespace(xmlData, i);
+
+        if (identifierType === 'PUBLIC') {
+            [i] = readQuotedValue(xmlData, i, 'publicIdentifier');
+            i = skipWhitespace(xmlData, i);
+            if (xmlData[i] === '"' || xmlData[i] === "'") {
+                [i] = readQuotedValue(xmlData, i, 'systemIdentifier');
+            }
+        } else if (identifierType === 'SYSTEM') {
+            [i] = readQuotedValue(xmlData, i, 'systemIdentifier');
+        }
+
+        return --i;
+    }
+
+    _validateElementExp(xmlData, i) {
+        i = skipWhitespace(xmlData, i);
+
+        // Read and validate element name
+        const nameStart = i;
+        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
+        const elementName = xmlData.substring(nameStart, i);
+        if (!this.suppressValidationErr && !isName(elementName)) {
+            throw new Error(`Invalid element name: "${elementName}"`);
+        }
+
+        i = skipWhitespace(xmlData, i);
+
+        // Validate content model keyword or group
+        if (xmlData[i] === 'E' && hasSeq(xmlData, 'MPTY', i)) {
+            i += 4;
+        } else if (xmlData[i] === 'A' && hasSeq(xmlData, 'NY', i)) {
+            i += 2;
+        } else if (xmlData[i] === '(') {
+            i++;
+            while (i < xmlData.length && xmlData[i] !== ')') i++;
+            if (xmlData[i] !== ')') throw new Error('Unterminated content model');
+        } else if (!this.suppressValidationErr) {
+            throw new Error(`Invalid Element Expression, found "${xmlData[i]}"`);
+        }
+
+        return i;
+    }
+
+    _validateAttlistExp(xmlData, i) {
+        i = skipWhitespace(xmlData, i);
+
+        // Read element name
+        const elemNameStart = i;
+        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
+        const elementName = xmlData.substring(elemNameStart, i);
+        validateName(elementName);
+
+        i = skipWhitespace(xmlData, i);
+
+        // Read attribute name
+        const attrNameStart = i;
+        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
+        const attributeName = xmlData.substring(attrNameStart, i);
+        validateName(attributeName);
+
+        i = skipWhitespace(xmlData, i);
+
+        // Read attribute type
+        if (xmlData.substring(i, i + 8).toUpperCase() === 'NOTATION') {
+            i += 8;
+            i = skipWhitespace(xmlData, i);
+            if (xmlData[i] !== '(') throw new Error(`Expected '(', found "${xmlData[i]}"`);
+            i++;
+            while (i < xmlData.length && xmlData[i] !== ')') {
+                const notationStart = i;
+                while (i < xmlData.length && xmlData[i] !== '|' && xmlData[i] !== ')') i++;
+                const notation = xmlData.substring(notationStart, i).trim();
+                validateName(notation);
+                if (xmlData[i] === '|') {
+                    i++;
+                    i = skipWhitespace(xmlData, i);
+                }
+            }
+            if (xmlData[i] !== ')') throw new Error('Unterminated list of notations');
+            i++;
+        } else {
+            const typeStart = i;
+            while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
+            const attributeType = xmlData.substring(typeStart, i);
+            const validTypes = ['CDATA', 'ID', 'IDREF', 'IDREFS', 'ENTITY', 'ENTITIES', 'NMTOKEN', 'NMTOKENS'];
+            if (!this.suppressValidationErr && !validTypes.includes(attributeType.toUpperCase())) {
+                throw new Error(`Invalid attribute type: "${attributeType}"`);
+            }
+        }
+
+        i = skipWhitespace(xmlData, i);
+
+        // Read default value declaration
+        if (xmlData.substring(i, i + 9).toUpperCase() === '#REQUIRED') {
+            i += 9;
+        } else if (xmlData.substring(i, i + 8).toUpperCase() === '#IMPLIED') {
+            i += 8;
+        } else {
+            [i] = readQuotedValue(xmlData, i, 'ATTLIST default value');
+        }
+
+        return i;
+    }
+}
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+function skipWhitespace(data, index) {
+    while (index < data.length && /\s/.test(data[index])) index++;
+    return index;
+}
+
+function hasSeq(data, seq, i) {
+    for (let j = 0; j < seq.length; j++) {
+        if (seq[j] !== data[i + j + 1]) return false;
+    }
+    return true;
+}
+
+function validateName(name) {
+    if (!isName(name)) throw new Error(`Invalid entity name "${name}"`);
+}
+
+/**
+ * Read a single- or double-quoted string and return [nextIndex, value].
+ */
+function readQuotedValue(xmlData, i, type) {
+    const startChar = xmlData[i];
+    if (startChar !== '"' && startChar !== "'") {
+        throw new Error(`Expected quoted string for ${type}, found "${startChar}"`);
+    }
+    i++;
+    const start = i;
+    while (i < xmlData.length && xmlData[i] !== startChar) i++;
+    if (xmlData[i] !== startChar) throw new Error(`Unterminated ${type} value`);
+    const value = xmlData.substring(start, i);
+    return [++i, value];
+}

package/src/ValidationError.js

@@ -0,0 +1,10 @@
+export default class ValidationError extends Error {
+  constructor(message, code, line, col) {
+    super(message);
+    this.name = this.constructor.name;
+    this.code = code;
+    this.line = line;
+    this.col = col;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}

package/src/fxv.d.ts

@@ -0,0 +1,115 @@
+
+export type docTypeOptions = {
+  /**
+   * maximum number of entity present in DOCTYPE 
+   * 
+   * Defaults to `Infinity`
+   */
+  maxEntityCount?: number;
+
+  /**
+   * maximum size of each entity present in DOCTYPE 
+   * 
+   * Defaults to `Infinity`
+   */
+  maxEntitySize?: number;
+}
+
+export type validationOptions = {
+  /**
+   * Whether to allow attributes without value
+   * 
+   * Defaults to `false`
+   */
+  allowBooleanAttributes?: boolean;
+
+  /**
+   * List of tags without closing tags
+   * 
+   * Defaults to `[]`
+   */
+  unpairedTags?: string[];
+
+  docType?: docTypeOptions;
+};
+
+export type ValidationError = {
+  err: {
+    code: string;
+    msg: string,
+    line: number,
+    col: number
+  };
+};
+
+export class SyntaxValidator {
+  static validate(xmlData: string, options?: validationOptions): true | ValidationError;
+}
+
+
+export interface BusinessRulesValidatorOptions {
+  unknownAllow?: boolean;
+  boolean?: string[];
+}
+
+export type ValidationFailure = {
+  code: string;
+  path: string;
+  value?: string;
+  actual?: number | string;
+  expected?: number | string;
+}
+
+export type CustomValidatorFn = (
+  value: string,
+  path: string
+) => ValidationFailure | Record<string, unknown> | undefined | null | void;
+
+export class BusinessRulesValidator {
+  /**
+   * Create a new Validator with a rules XML string.
+   *
+   * @param rules   - XML string whose attributes define validation constraints.
+   * @param options - Optional configuration.
+   *
+   * @throws {Error} If `rules` is empty, not a string, or contains XML syntax errors.
+   *
+   * @example
+   * ```ts
+   * const validator = new Validator(`
+   *   <students>
+   *     <student repeatable minOccurs="1">
+   *       <email unique="true" nillable="false"></email>
+   *       <age type="integer" range="18..65"></age>
+   *     </student>
+   *   </students>
+   * `);
+   * ```
+   */
+  constructor(rules: string, options?: BusinessRulesValidatorOptions);
+
+  /**
+   * Register a custom validation function under a name.
+   * Reference it in rules XML with `checkBy="<name>"`.
+   *
+   * @example
+   * ```ts
+   * validator.register("isEmail", (value, path) => {
+   *   if (!value.includes("@")) {
+   *     return { code: "invalid-email", path, value };
+   *   }
+   * });
+   * ```
+   */
+  register(name: string, fn: CustomValidatorFn): void;
+
+  /**
+   * Validate an XML string against the rules.
+   *
+   * @param xmldata - XML string to validate.
+   * @returns Array of failure objects. Empty array means the document is valid.
+   *
+   * @throws {Error} If `xmldata` is empty, not a string, or contains XML syntax errors.
+   */
+  validate(xmldata: string): ValidationFailure[];
+}

package/src/fxv.js

@@ -0,0 +1,12 @@
+'use strict';
+
+import { validate as validateSyntax } from './validator.js';
+import BusinessRulesValidator from 'detailed-xml-validator';
+
+class SyntaxValidator {
+  static validate(xmlData, options) {
+    return validateSyntax(xmlData, options);
+  }
+}
+
+export { SyntaxValidator, BusinessRulesValidator };

package/src/util.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const nameStartChar = ':A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD';
+const nameChar = nameStartChar + '\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040';
+export const nameRegexp = '[' + nameStartChar + '][' + nameChar + ']*';
+const regexName = new RegExp('^' + nameRegexp + '$');
+
+export function getAllMatches(string, regex) {
+  const matches = [];
+  let match = regex.exec(string);
+  while (match) {
+    const allmatches = [];
+    allmatches.startIndex = regex.lastIndex - match[0].length;
+    const len = match.length;
+    for (let index = 0; index < len; index++) {
+      allmatches.push(match[index]);
+    }
+    matches.push(allmatches);
+    match = regex.exec(string);
+  }
+  return matches;
+}
+
+export const isName = function (string) {
+  const match = regexName.exec(string);
+  return !(match === null || typeof match === 'undefined');
+}
+
+export function isExist(v) {
+  return typeof v !== 'undefined';
+}
+
+export function isEmptyObject(obj) {
+  return Object.keys(obj).length === 0;
+}
+
+export function getValue(v) {
+  if (exports.isExist(v)) {
+    return v;
+  } else {
+    return '';
+  }
+}
+
+/**
+ * Dangerous property names that could lead to prototype pollution or security issues
+ */
+export const DANGEROUS_PROPERTY_NAMES = [
+  // '__proto__',
+  // 'constructor',
+  // 'prototype',
+  'hasOwnProperty',
+  'toString',
+  'valueOf',
+  '__defineGetter__',
+  '__defineSetter__',
+  '__lookupGetter__',
+  '__lookupSetter__'
+];
+
+export const criticalProperties = ["__proto__", "constructor", "prototype"];