fast-xml-validator 1.4.0 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-xml-validator",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Validate XML for Syntax and Business rules without C/C++ based libraries",
   "main": "./lib/fxv.cjs",
   "type": "module",
@@ -69,4 +69,4 @@
     "path-expression-matcher": "^1.6.2",
     "xml-naming": "^0.3.0"
   }
-}
+}

package/src/fxv.d.ts

@@ -107,7 +107,7 @@ export type ValidationError = {
 export class SyntaxValidator {
   constructor(options?: validationOptions);
   validate(xmlData: string): true;
-  static validate(xmlData: string, options?: validationOptions): true | ValidationError;
+  static validate(xmlData: string, options?: validationOptions): true;
 }
 
 

package/src/validators/AttributeStringValidator.js

@@ -1,9 +1,106 @@
 'use strict';
 
-import { getAllMatches, getPositionFromMatch } from '../util.js';
+import { getPositionFromMatch, isWhiteSpace } from '../util.js';
 import ControlCharValidator from './ControlCharValidator.js';
 
-const validAttrStrRegxp = new RegExp('(\\s*)([^\\s=]+)(\\s*=)?(\\s*([\'"])(([\\s\\S])*?)\\5)?', 'g');
+/**
+ * Walk `attrStr` once, left to right, splitting it into attribute tokens.
+ *
+ * This replaces a regex that used to do the same job
+ * (`(\s*)([^\s=]+)(\s*=)?(\s*(['"])(([\s\S])*?)\5)?`). That regex led with an
+ * optional whitespace group followed by a required "non-whitespace" group.
+ * On a long run of whitespace that never resolves into an attribute name
+ * (e.g. a tag with thousands of trailing spaces before `>`), the engine
+ * backtracks the whitespace group one character at a time before giving up
+ * and moving to the next starting position — one full backtrack per
+ * position, which is quadratic in the length of the run. A ~64KB tag made
+ * entirely of spaces could stall the whole process for seconds.
+ *
+ * A single forward-only scan can never backtrack, so it can't be made slow
+ * this way no matter how much whitespace the input contains — it's always
+ * proportional to the length of the string, once.
+ *
+ * Each returned token mirrors the shape the old regex match array had, so
+ * the validation logic below (which reads token[1]..token[6]) didn't need
+ * to change:
+ *   token.startIndex - where this token begins in attrStr
+ *   token[1]          - leading whitespace before the name
+ *   token[2]          - the attribute name
+ *   token[3]          - whitespace + '=' if present, else undefined
+ *   token[4]          - marker (any defined value) if a quoted value was found
+ *   token[5]          - the quote character used ('"' or "'")
+ *   token[6]          - the value's text, without the surrounding quotes
+ *
+ * A malformed leading character (e.g. a stray '=' with no name before it)
+ * is simply skipped over, one character at a time — the same outcome the
+ * old regex produced by failing to match at that position and retrying at
+ * the next one.
+ */
+function scanAttributeTokens(attrStr) {
+  const tokens = [];
+  const len = attrStr.length;
+  let i = 0;
+
+  while (i < len) {
+    const tokenStart = i;
+
+    // Leading whitespace before the name.
+    while (i < len && isWhiteSpace(attrStr[i])) i++;
+    if (i >= len) break; // trailing whitespace only — nothing left to read
+
+    if (attrStr[i] === '=') {
+      // No name before this '=' — not a valid attribute start. Move past
+      // just this one character and try again from the next position.
+      i = tokenStart + 1;
+      continue;
+    }
+
+    const leadingWs = attrStr.slice(tokenStart, i);
+
+    // Attribute name — everything up to the next whitespace or '='.
+    const nameStart = i;
+    while (i < len && !isWhiteSpace(attrStr[i]) && attrStr[i] !== '=') i++;
+    const name = attrStr.slice(nameStart, i);
+
+    // Optional whitespace + '='.
+    let equalsGroup; // whitespace + '=' text, or undefined if absent
+    let j = i;
+    while (j < len && isWhiteSpace(attrStr[j])) j++;
+    if (j < len && attrStr[j] === '=') {
+      equalsGroup = attrStr.slice(i, j + 1);
+      i = j + 1;
+    }
+
+    // Optional whitespace + quoted value.
+    let quoteChar;
+    let value;
+    let k = i;
+    while (k < len && isWhiteSpace(attrStr[k])) k++;
+    if (k < len && (attrStr[k] === '"' || attrStr[k] === "'")) {
+      const valueStart = k + 1;
+      const closeIdx = attrStr.indexOf(attrStr[k], valueStart);
+      if (closeIdx !== -1) {
+        quoteChar = attrStr[k];
+        value = attrStr.slice(valueStart, closeIdx);
+        i = closeIdx + 1;
+      }
+      // No closing quote found anywhere in the rest of the string — leave
+      // quoteChar/value undefined, same as the old regex's group failing
+      // to match a backreference-less run.
+    }
+
+    const token = { startIndex: tokenStart };
+    token[1] = leadingWs;
+    token[2] = name;
+    token[3] = equalsGroup;
+    token[4] = quoteChar !== undefined ? true : undefined;
+    token[5] = quoteChar;
+    token[6] = value;
+    tokens.push(token);
+  }
+
+  return tokens;
+}
 
 /**
  * AttributeStringValidator — single responsibility: validate the raw
@@ -40,7 +137,7 @@ export default class AttributeStringValidator {
    * @returns {true | { err: { code: string, msg: string, line: number } }}
    */
   validate(attrStr) {
-    const matches = getAllMatches(attrStr, validAttrStrRegxp);
+    const matches = scanAttributeTokens(attrStr);
     const attrNames = {};
     const checkAttrLt = this.options.invalidCharSequence?.attrLt === true;
 
@@ -112,4 +209,4 @@ export default class AttributeStringValidator {
   _err(code, msg, match) {
     return { err: { code, msg, line: getPositionFromMatch(match) } };
   }
-}
+}

package/src/validators/DocTypeValidator.js

@@ -28,9 +28,21 @@ export default class DocTypeValidator {
         let angleBracketsCount = 1;
         let hasBody = false;
         let comment = false;
+        let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
         let entityCount = 0;
 
         for (; i < xmlData.length; i++) {
+            // Inside a quoted external-identifier literal — '<' and '>' are
+            // plain data here per the XML grammar, not DOCTYPE structure.
+            if (quoteChar !== null) {
+                if (xmlData[i] === quoteChar) quoteChar = null;
+                continue;
+            }
+            if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
+                quoteChar = xmlData[i];
+                continue;
+            }
+
             if (xmlData[i] === '<' && !comment) {
                 if (hasBody && hasSeq(xmlData, '!ENTITY', i)) {
                     i += 7;
@@ -69,7 +81,7 @@ export default class DocTypeValidator {
             }
         }
 
-        if (angleBracketsCount !== 0) {
+        if (quoteChar !== null || angleBracketsCount !== 0) {
             throw new Error(`Unclosed DOCTYPE`);
         }
 

package/src/validators/XmlDeclarationValidator.js

@@ -1,5 +1,93 @@
 'use strict';
 
+import { isWhiteSpace } from '../util.js';
+
+function isWordChar(ch) {
+  return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch === '_';
+}
+
+/**
+ * Walk the `<?xml ... ?>` body once, left to right, pulling out
+ * `name="value"` / `name='value'` pairs (each one preceded by required
+ * whitespace) and collecting everything else as leftover text.
+ *
+ * This replaces two regexes that used to do the same job:
+ *   /\s+([\w]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g          - to find attributes
+ *   /\s+[\w]+\s*=\s*(?:"[^"]*"|'[^']*')/g (via replace)  - to find leftovers
+ *
+ * Both led with a required-but-greedy `\s+`. On a long run of whitespace
+ * that's never followed by a valid `name=value`, the engine backtracks that
+ * whitespace group one character at a time before giving up on that
+ * starting position — and since none of those backtracked attempts can ever
+ * succeed (a whitespace character is never a valid name character, at any
+ * backtrack length), all of that retrying was wasted work. A `<?xml ?>`
+ * declaration padded with thousands of spaces could make this step take
+ * seconds. Scanning forward once, without ever revisiting a position, is
+ * both faster and gives the identical result — the retried attempts could
+ * never have succeeded anyway.
+ *
+ * @param {string} declBody
+ * @returns {{ matches: Array<{name: string, value: string, index: number}>, leftover: string }}
+ */
+function scanDeclAttributes(declBody) {
+  const matches = [];
+  let leftover = '';
+  const len = declBody.length;
+  let i = 0;
+
+  while (i < len) {
+    if (!isWhiteSpace(declBody[i])) {
+      leftover += declBody[i];
+      i++;
+      continue;
+    }
+
+    const matchStart = i;
+    let p = i;
+    while (p < len && isWhiteSpace(declBody[p])) p++;
+
+    const nameStart = p;
+    while (p < len && isWordChar(declBody[p])) p++;
+    if (p === nameStart) {
+      // Whitespace not followed by a name character — can't become a match
+      // no matter how much of the whitespace we consider, so it's leftover.
+      leftover += declBody.slice(matchStart, p + 1 <= len ? p : len);
+      i = p > matchStart ? p : matchStart + 1;
+      continue;
+    }
+    const name = declBody.slice(nameStart, p);
+
+    let q = p;
+    while (q < len && isWhiteSpace(declBody[q])) q++;
+    if (declBody[q] !== '=') {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+    q++; // skip '='
+    while (q < len && isWhiteSpace(declBody[q])) q++;
+
+    const quote = declBody[q];
+    if (quote !== '"' && quote !== "'") {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+    const valueStart = q + 1;
+    const closeIdx = declBody.indexOf(quote, valueStart);
+    if (closeIdx === -1) {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+
+    matches.push({ name, value: declBody.slice(valueStart, closeIdx), index: matchStart });
+    i = closeIdx + 1;
+  }
+
+  return { matches, leftover };
+}
+
 /**
  * XmlDeclarationValidator — single responsibility: parse and validate the
  * `<?xml version="..." encoding="..." standalone="..."?>` prolog.
@@ -49,16 +137,15 @@ export default class XmlDeclarationValidator {
     const end = piEnd + 2;
 
     const ALLOWED = ['version', 'encoding', 'standalone'];
-    const attrRe = /\s+([\w]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+    const { matches: declAttrs, leftover } = scanDeclAttributes(declBody);
 
     let version = '1.0';
     let lastAllowedIdx = -1;
-    let match;
 
-    while ((match = attrRe.exec(declBody)) !== null) {
-      const attrName = match[1];
-      const attrValue = match[2] !== undefined ? match[2] : match[3];
-      const attrPos = match.index;
+    for (let m = 0; m < declAttrs.length; m++) {
+      const attrName = declAttrs[m].name;
+      const attrValue = declAttrs[m].value;
+      const attrPos = declAttrs[m].index;
 
       const allowedIdx = ALLOWED.indexOf(attrName);
       if (allowedIdx === -1) {
@@ -91,13 +178,13 @@ export default class XmlDeclarationValidator {
       // encoding: value format validation is out of scope
     }
 
-    const leftover = declBody.replace(/\s+[\w]+\s*=\s*(?:"[^"]*"|'[^']*')/g, '').trim();
-    if (leftover.length > 0) {
+    const trimmedLeftover = leftover.trim();
+    if (trimmedLeftover.length > 0) {
       this._throwError('InvalidXml',
-        'XML declaration contains invalid content: "' + leftover + '".',
+        'XML declaration contains invalid content: "' + trimmedLeftover + '".',
         { line: 1, col: 1 });
     }
 
     return { version, end };
   }
-}
+}

package/src/DocTypeValidator.js

@@ -1,280 +0,0 @@
-import { name as isXmlName } from 'xml-naming';
-
-const defaultOptions = {
-    maxEntityCount: Infinity,
-    maxEntitySize: Infinity,
-};
-
-export default class DocTypeValidator {
-    constructor(options, xmlVersion = '1.0') {
-        this.options = Object.assign({}, defaultOptions, options);
-        this.suppressValidationErr = !options;
-        this.xmlVersion = xmlVersion;
-    }
-
-    validateDocType(xmlData, i) {
-        if (
-            xmlData[i + 3] !== 'O' ||
-            xmlData[i + 4] !== 'C' ||
-            xmlData[i + 5] !== 'T' ||
-            xmlData[i + 6] !== 'Y' ||
-            xmlData[i + 7] !== 'P' ||
-            xmlData[i + 8] !== 'E'
-        ) {
-            throw new Error(`Invalid Tag instead of DOCTYPE`);
-        }
-
-        i += 9;
-        let angleBracketsCount = 1;
-        let hasBody = false;
-        let comment = false;
-        let entityCount = 0;
-
-        for (; i < xmlData.length; i++) {
-            if (xmlData[i] === '<' && !comment) {
-                if (hasBody && hasSeq(xmlData, '!ENTITY', i)) {
-                    i += 7;
-                    [entityCount, i] = this._validateEntityExp(xmlData, i + 1, entityCount);
-                    // continue;
-                } else if (hasBody && hasSeq(xmlData, '!ELEMENT', i)) {
-                    i += 8;
-                    i = this._validateElementExp(xmlData, i + 1);
-                    // continue;
-                } else if (hasBody && hasSeq(xmlData, '!ATTLIST', i)) {
-                    i += 8;
-                    i = this._validateAttlistExp(xmlData, i + 1);
-                    continue;
-                } else if (hasBody && hasSeq(xmlData, '!NOTATION', i)) {
-                    i += 9;
-                    i = this._validateNotationExp(xmlData, i + 1);
-                    // continue;
-                } else if (hasSeq(xmlData, '!--', i)) {
-                    comment = true;
-                } else {
-                    throw new Error(`Invalid DOCTYPE`);
-                }
-                angleBracketsCount++;
-            } else if (xmlData[i] === '>') {
-                if (comment) {
-                    if (xmlData[i - 1] === '-' && xmlData[i - 2] === '-') {
-                        comment = false;
-                        angleBracketsCount--;
-                    }
-                } else {
-                    angleBracketsCount--;
-                }
-                if (angleBracketsCount === 0) break;
-            } else if (xmlData[i] === '[') {
-                hasBody = true;
-            }
-        }
-
-        if (angleBracketsCount !== 0) {
-            throw new Error(`Unclosed DOCTYPE`);
-        }
-
-        return i;
-    }
-
-    _validateEntityExp(xmlData, i, entityCount) {
-        i = skipWhitespace(xmlData, i);
-
-        // Read and validate entity name
-        const nameStart = i;
-        while (i < xmlData.length && !/\s/.test(xmlData[i]) && xmlData[i] !== '"' && xmlData[i] !== "'") {
-            i++;
-        }
-        const entityName = xmlData.substring(nameStart, i);
-        validateName(entityName, this.xmlVersion);
-
-        i = skipWhitespace(xmlData, i);
-
-        // Check for unsupported constructs
-        if (!this.suppressValidationErr) {
-            if (xmlData.substring(i, i + 6).toUpperCase() === 'SYSTEM') {
-                throw new Error('External entities are not supported');
-            } else if (xmlData[i] === '%') {
-                throw new Error('Parameter entities are not supported');
-            }
-        }
-
-        // Read and validate the entity value (validates quoting + size limit)
-        let entityValue;
-        [i, entityValue] = readQuotedValue(xmlData, i, 'entity');
-
-        const { maxEntitySize, maxEntityCount } = this.options;
-
-        if (entityValue.length > maxEntitySize) {
-            throw new Error(
-                `Entity "${entityName}" size (${entityValue.length}) exceeds maximum allowed size (${maxEntitySize})`
-            );
-        }
-
-        // Only count non-parameter entities (parameter entities contain '&')
-        if (entityValue.indexOf('&') === -1) {
-            entityCount++;
-            if (entityCount > maxEntityCount) {
-                throw new Error(
-                    `Entity count (${entityCount}) exceeds maximum allowed (${maxEntityCount})`
-                );
-            }
-        }
-
-        return [entityCount, i - 1];
-    }
-
-    _validateNotationExp(xmlData, i) {
-        i = skipWhitespace(xmlData, i);
-
-        // Read and validate notation name
-        const nameStart = i;
-        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
-        const notationName = xmlData.substring(nameStart, i);
-        !this.suppressValidationErr && validateName(notationName, this.xmlVersion);
-
-        i = skipWhitespace(xmlData, i);
-
-        const identifierType = xmlData.substring(i, i + 6).toUpperCase();
-        if (!this.suppressValidationErr && identifierType !== 'SYSTEM' && identifierType !== 'PUBLIC') {
-            throw new Error(`Expected SYSTEM or PUBLIC, found "${identifierType}"`);
-        }
-        i += identifierType.length;
-        i = skipWhitespace(xmlData, i);
-
-        if (identifierType === 'PUBLIC') {
-            [i] = readQuotedValue(xmlData, i, 'publicIdentifier');
-            i = skipWhitespace(xmlData, i);
-            if (xmlData[i] === '"' || xmlData[i] === "'") {
-                [i] = readQuotedValue(xmlData, i, 'systemIdentifier');
-            }
-        } else if (identifierType === 'SYSTEM') {
-            [i] = readQuotedValue(xmlData, i, 'systemIdentifier');
-        }
-
-        return --i;
-    }
-
-    _validateElementExp(xmlData, i) {
-        i = skipWhitespace(xmlData, i);
-
-        // Read and validate element name
-        const nameStart = i;
-        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
-        const elementName = xmlData.substring(nameStart, i);
-        if (!this.suppressValidationErr && !isXmlName(elementName, { xmlVersion: this.xmlVersion })) {
-            throw new Error(`Invalid element name: "${elementName}"`);
-        }
-
-        i = skipWhitespace(xmlData, i);
-
-        // Validate content model keyword or group
-        if (xmlData[i] === 'E' && hasSeq(xmlData, 'MPTY', i)) {
-            i += 4;
-        } else if (xmlData[i] === 'A' && hasSeq(xmlData, 'NY', i)) {
-            i += 2;
-        } else if (xmlData[i] === '(') {
-            i++;
-            while (i < xmlData.length && xmlData[i] !== ')') i++;
-            if (xmlData[i] !== ')') throw new Error('Unterminated content model');
-        } else if (!this.suppressValidationErr) {
-            throw new Error(`Invalid Element Expression, found "${xmlData[i]}"`);
-        }
-
-        return i;
-    }
-
-    _validateAttlistExp(xmlData, i) {
-        i = skipWhitespace(xmlData, i);
-
-        // Read element name
-        const elemNameStart = i;
-        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
-        const elementName = xmlData.substring(elemNameStart, i);
-        validateName(elementName, this.xmlVersion);
-
-        i = skipWhitespace(xmlData, i);
-
-        // Read attribute name
-        const attrNameStart = i;
-        while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
-        const attributeName = xmlData.substring(attrNameStart, i);
-        validateName(attributeName, this.xmlVersion);
-
-        i = skipWhitespace(xmlData, i);
-
-        // Read attribute type
-        if (xmlData.substring(i, i + 8).toUpperCase() === 'NOTATION') {
-            i += 8;
-            i = skipWhitespace(xmlData, i);
-            if (xmlData[i] !== '(') throw new Error(`Expected '(', found "${xmlData[i]}"`);
-            i++;
-            while (i < xmlData.length && xmlData[i] !== ')') {
-                const notationStart = i;
-                while (i < xmlData.length && xmlData[i] !== '|' && xmlData[i] !== ')') i++;
-                const notation = xmlData.substring(notationStart, i).trim();
-                validateName(notation, this.xmlVersion);
-                if (xmlData[i] === '|') {
-                    i++;
-                    i = skipWhitespace(xmlData, i);
-                }
-            }
-            if (xmlData[i] !== ')') throw new Error('Unterminated list of notations');
-            i++;
-        } else {
-            const typeStart = i;
-            while (i < xmlData.length && !/\s/.test(xmlData[i])) i++;
-            const attributeType = xmlData.substring(typeStart, i);
-            const validTypes = ['CDATA', 'ID', 'IDREF', 'IDREFS', 'ENTITY', 'ENTITIES', 'NMTOKEN', 'NMTOKENS'];
-            if (!this.suppressValidationErr && !validTypes.includes(attributeType.toUpperCase())) {
-                throw new Error(`Invalid attribute type: "${attributeType}"`);
-            }
-        }
-
-        i = skipWhitespace(xmlData, i);
-
-        // Read default value declaration
-        if (xmlData.substring(i, i + 9).toUpperCase() === '#REQUIRED') {
-            i += 9;
-        } else if (xmlData.substring(i, i + 8).toUpperCase() === '#IMPLIED') {
-            i += 8;
-        } else {
-            [i] = readQuotedValue(xmlData, i, 'ATTLIST default value');
-        }
-
-        return i;
-    }
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-function skipWhitespace(data, index) {
-    while (index < data.length && /\s/.test(data[index])) index++;
-    return index;
-}
-
-function hasSeq(data, seq, i) {
-    for (let j = 0; j < seq.length; j++) {
-        if (seq[j] !== data[i + j + 1]) return false;
-    }
-    return true;
-}
-
-function validateName(name, xmlVersion = '1.0') {
-    if (!isXmlName(name, { xmlVersion })) throw new Error(`Invalid entity name "${name}"`);
-}
-
-/**
- * Read a single- or double-quoted string and return [nextIndex, value].
- */
-function readQuotedValue(xmlData, i, type) {
-    const startChar = xmlData[i];
-    if (startChar !== '"' && startChar !== "'") {
-        throw new Error(`Expected quoted string for ${type}, found "${startChar}"`);
-    }
-    i++;
-    const start = i;
-    while (i < xmlData.length && xmlData[i] !== startChar) i++;
-    if (xmlData[i] !== startChar) throw new Error(`Unterminated ${type} value`);
-    const value = xmlData.substring(start, i);
-    return [++i, value];
-}