fast-xml-validator 1.4.1 → 1.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fast-xml-validator",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "Validate XML for Syntax and Business rules without C/C++ based libraries",
   "main": "./lib/fxv.cjs",
   "type": "module",
@@ -21,7 +21,8 @@
   },
   "scripts": {
     "test": "c8 --reporter=lcov --reporter=text jasmine specs/*spec.js",
-    "bundle": "webpack --config webpack.cjs.config.js"
+    "bundle": "webpack --config webpack.cjs.config.js",
+    "codemap": "codebase-map scan && codebase-map format --format dsl --include \"src/**\" > .codebase-map.dsl"
   },
   "files": [
     "lib",
@@ -52,6 +53,7 @@
     "@types/node": "20",
     "babel-loader": "^8.2.2",
     "c8": "^10.1.3",
+    "codebase-map": "^0.6.1",
     "eslint": "^8.3.0",
     "jasmine": "^5.6.0",
     "typescript": "5",

package/src/SyntaxValidator.js

@@ -100,6 +100,24 @@ export default class SyntaxValidator {
       docTypeSeen = true;
     };
 
+    // Character data (text, entity references, CDATA) is only legal inside an
+    // element. At depth 0 it is "extra" data, whether before or after the root.
+    const checkTopLevelText = (pos) => {
+      if (tags.length === 0) {
+        throwError('InvalidXml', 'Extra text at the end', getLineNumberForPosition(xmlData, pos));
+      }
+    };
+
+    const checkCdataPlacement = (startBang) => {
+      if (tags.length === 0 && xmlData.startsWith('<![CDATA[', startBang)) {
+        throwError(
+          'InvalidXml',
+          'CDATA section is not allowed outside the root element.',
+          getLineNumberForPosition(xmlData, startBang)
+        );
+      }
+    };
+
     for (let i = 0; i < xmlData.length; i++) {
       if (xmlData[i] === '<' && xmlData[i + 1] === '?') {
         i += 2;
@@ -109,6 +127,7 @@ export default class SyntaxValidator {
         i++;
 
         if (xmlData[i] === '!') {
+          checkCdataPlacement(tagStartPos);
           try {
             checkDocTypePlacement(tagStartPos);
             i = commentCdataReader.read(xmlData, i, docTypeValidator);
@@ -214,14 +233,16 @@ export default class SyntaxValidator {
               throwError('InvalidXml', 'Multiple possible root nodes found.', getLineNumberForPosition(xmlData, i));
             } else if (options.unpairedTags.indexOf(tagName) !== -1) {
               skipMatcher.pop();
+              // An unpaired tag at depth 0 is a complete top-level element.
+              if (tags.length === 0) reachedRoot = true;
             } else if (skip) {
               // Consume the whole skipped subtree now, as opaque raw text,
-              // then continue scanning right after its closing tag.
+              // then fall through to the text scan below so that whatever
+              // follows the skipped tag's closing '>' (text, entities,
+              // comments, the next tag) is handled like after any other tag.
               i = RawSubtreeReader.consume(xmlData, tagName, i + 1);
               skipMatcher.pop();
               if (tags.length === 0) reachedRoot = true;
-              tagFound = true;
-              continue;
             } else {
               tags.push({ tagName, tagStartPos });
             }
@@ -235,6 +256,7 @@ export default class SyntaxValidator {
             if (xmlData[i] === '<') {
               if (xmlData[i + 1] === '!') {
                 i++;
+                checkCdataPlacement(i - 1);
                 try {
                   checkDocTypePlacement(i - 1);
                   i = commentCdataReader.read(xmlData, i, docTypeValidator);
@@ -251,6 +273,7 @@ export default class SyntaxValidator {
                 break;
               }
             } else if (xmlData[i] === '&') {
+              checkTopLevelText(i);
               const afterAmp = this._validateAmpersand(xmlData, i);
               if (afterAmp === -1)
                 throwError('InvalidChar', "char '&' is not expected.", getLineNumberForPosition(xmlData, i));
@@ -261,7 +284,7 @@ export default class SyntaxValidator {
               if (isIllegalControlCode(code)) {
                 throwError('IllegalCharacter', `Illegal control character ${ControlCharValidator.describe(code)} in document content.`, getLineNumberForPosition(xmlData, i));
               }
-              if (reachedRoot === true && tags.length === 0 && !isWhiteSpace(xmlData[i])) {
+              if (tags.length === 0 && !isWhiteSpace(xmlData[i])) {
                 throwError('InvalidXml', 'Extra text at the end', getLineNumberForPosition(xmlData, i));
               }
               if (checkTagValueSeq) {

package/src/fxv.d.ts

@@ -1,19 +1,18 @@
-
 export type docTypeOptions = {
   /**
-   * maximum number of entity present in DOCTYPE 
-   * 
+   * maximum number of entity present in DOCTYPE
+   *
    * Defaults to `Infinity`
    */
   maxEntityCount?: number;
 
   /**
-   * maximum size of each entity present in DOCTYPE 
-   * 
+   * maximum size of each entity present in DOCTYPE
+   *
    * Defaults to `Infinity`
    */
   maxEntitySize?: number;
-}
+};
 
 export type invalidCharSequenceOptions = {
   /**
@@ -59,14 +58,14 @@ export type xmlDeclarationOptions = {
 export type validationOptions = {
   /**
    * Whether to allow attributes without value
-   * 
+   *
    * Defaults to `false`
    */
   allowBooleanAttributes?: boolean;
 
   /**
    * List of tags without closing tags
-   * 
+   *
    * Defaults to `[]`
    */
   unpairedTags?: string[];
@@ -79,10 +78,13 @@ export type validationOptions = {
   /** Controls handling of the `<?xml ... ?>` prolog. */
   xmlDeclaraion?: xmlDeclarationOptions;
 
+  /** Correctly-spelled alias of `xmlDeclaraion`. */
+  xmlDeclaration?: xmlDeclarationOptions;
+
   /**
    * Allow more than one root-level element (as if wrapped in a virtual root).
    *
-   * Defaults to `false`.
+   * Defaults to `true`.
    */
   multipleRoots?: boolean;
 
@@ -95,22 +97,46 @@ export type validationOptions = {
   skipTags?: string[];
 };
 
-export type ValidationError = {
-  err: {
-    code: string;
-    msg: string,
-    line: number,
-    col: number
-  };
-};
+/**
+ * Known error codes. The union stays open (`string & {}`) so new codes
+ * added in the future don't break consumers' exhaustive checks.
+ */
+export type ValidationErrorCode =
+  | 'InvalidXml'
+  | 'InvalidTag'
+  | 'InvalidAttr'
+  | 'InvalidChar'
+  | 'InvalidDocType'
+  | 'IllegalCharacter'
+  | 'UnquotedAttributeValue'
+  | (string & {});
+
+/**
+ * Thrown by `SyntaxValidator#validate` on the first well-formedness problem.
+ */
+export class ValidationError extends Error {
+  constructor(message: string, code: ValidationErrorCode, line: number, col: number);
+  code: ValidationErrorCode;
+  line: number;
+  col: number;
+}
 
 export class SyntaxValidator {
   constructor(options?: validationOptions);
+
+  /**
+   * @returns `true` when the document is well-formed.
+   * @throws {ValidationError} on the first problem found.
+   */
   validate(xmlData: string): true;
+
+  /**
+   * @returns `true` when the document is well-formed.
+   * @throws {ValidationError} on the first problem found.
+   */
   static validate(xmlData: string, options?: validationOptions): true;
 }
 
-
 export interface BusinessRulesValidatorOptions {
   unknownAllow?: boolean;
   boolean?: string[];
@@ -122,7 +148,7 @@ export type ValidationFailure = {
   value?: string;
   actual?: number | string;
   expected?: number | string;
-}
+};
 
 export type CustomValidatorFn = (
   value: string,
@@ -140,7 +166,7 @@ export class BusinessRulesValidator {
    *
    * @example
    * ```ts
-   * const validator = new Validator(`
+   * const validator = new BusinessRulesValidator(`
    *   <students>
    *     <student repeatable minOccurs="1">
    *       <email unique="true" nillable="false"></email>

package/src/validators/AttributeStringValidator.js

@@ -1,9 +1,106 @@
 'use strict';
 
-import { getAllMatches, getPositionFromMatch } from '../util.js';
+import { getPositionFromMatch, isWhiteSpace } from '../util.js';
 import ControlCharValidator from './ControlCharValidator.js';
 
-const validAttrStrRegxp = new RegExp('(\\s*)([^\\s=]+)(\\s*=)?(\\s*([\'"])(([\\s\\S])*?)\\5)?', 'g');
+/**
+ * Walk `attrStr` once, left to right, splitting it into attribute tokens.
+ *
+ * This replaces a regex that used to do the same job
+ * (`(\s*)([^\s=]+)(\s*=)?(\s*(['"])(([\s\S])*?)\5)?`). That regex led with an
+ * optional whitespace group followed by a required "non-whitespace" group.
+ * On a long run of whitespace that never resolves into an attribute name
+ * (e.g. a tag with thousands of trailing spaces before `>`), the engine
+ * backtracks the whitespace group one character at a time before giving up
+ * and moving to the next starting position — one full backtrack per
+ * position, which is quadratic in the length of the run. A ~64KB tag made
+ * entirely of spaces could stall the whole process for seconds.
+ *
+ * A single forward-only scan can never backtrack, so it can't be made slow
+ * this way no matter how much whitespace the input contains — it's always
+ * proportional to the length of the string, once.
+ *
+ * Each returned token mirrors the shape the old regex match array had, so
+ * the validation logic below (which reads token[1]..token[6]) didn't need
+ * to change:
+ *   token.startIndex - where this token begins in attrStr
+ *   token[1]          - leading whitespace before the name
+ *   token[2]          - the attribute name
+ *   token[3]          - whitespace + '=' if present, else undefined
+ *   token[4]          - marker (any defined value) if a quoted value was found
+ *   token[5]          - the quote character used ('"' or "'")
+ *   token[6]          - the value's text, without the surrounding quotes
+ *
+ * A malformed leading character (e.g. a stray '=' with no name before it)
+ * is simply skipped over, one character at a time — the same outcome the
+ * old regex produced by failing to match at that position and retrying at
+ * the next one.
+ */
+function scanAttributeTokens(attrStr) {
+  const tokens = [];
+  const len = attrStr.length;
+  let i = 0;
+
+  while (i < len) {
+    const tokenStart = i;
+
+    // Leading whitespace before the name.
+    while (i < len && isWhiteSpace(attrStr[i])) i++;
+    if (i >= len) break; // trailing whitespace only — nothing left to read
+
+    if (attrStr[i] === '=') {
+      // No name before this '=' — not a valid attribute start. Move past
+      // just this one character and try again from the next position.
+      i = tokenStart + 1;
+      continue;
+    }
+
+    const leadingWs = attrStr.slice(tokenStart, i);
+
+    // Attribute name — everything up to the next whitespace or '='.
+    const nameStart = i;
+    while (i < len && !isWhiteSpace(attrStr[i]) && attrStr[i] !== '=') i++;
+    const name = attrStr.slice(nameStart, i);
+
+    // Optional whitespace + '='.
+    let equalsGroup; // whitespace + '=' text, or undefined if absent
+    let j = i;
+    while (j < len && isWhiteSpace(attrStr[j])) j++;
+    if (j < len && attrStr[j] === '=') {
+      equalsGroup = attrStr.slice(i, j + 1);
+      i = j + 1;
+    }
+
+    // Optional whitespace + quoted value.
+    let quoteChar;
+    let value;
+    let k = i;
+    while (k < len && isWhiteSpace(attrStr[k])) k++;
+    if (k < len && (attrStr[k] === '"' || attrStr[k] === "'")) {
+      const valueStart = k + 1;
+      const closeIdx = attrStr.indexOf(attrStr[k], valueStart);
+      if (closeIdx !== -1) {
+        quoteChar = attrStr[k];
+        value = attrStr.slice(valueStart, closeIdx);
+        i = closeIdx + 1;
+      }
+      // No closing quote found anywhere in the rest of the string — leave
+      // quoteChar/value undefined, same as the old regex's group failing
+      // to match a backreference-less run.
+    }
+
+    const token = { startIndex: tokenStart };
+    token[1] = leadingWs;
+    token[2] = name;
+    token[3] = equalsGroup;
+    token[4] = quoteChar !== undefined ? true : undefined;
+    token[5] = quoteChar;
+    token[6] = value;
+    tokens.push(token);
+  }
+
+  return tokens;
+}
 
 /**
  * AttributeStringValidator — single responsibility: validate the raw
@@ -40,7 +137,7 @@ export default class AttributeStringValidator {
    * @returns {true | { err: { code: string, msg: string, line: number } }}
    */
   validate(attrStr) {
-    const matches = getAllMatches(attrStr, validAttrStrRegxp);
+    const matches = scanAttributeTokens(attrStr);
     const attrNames = {};
     const checkAttrLt = this.options.invalidCharSequence?.attrLt === true;
 
@@ -112,4 +209,4 @@ export default class AttributeStringValidator {
   _err(code, msg, match) {
     return { err: { code, msg, line: getPositionFromMatch(match) } };
   }
-}
+}

package/src/validators/DocTypeValidator.js

@@ -28,9 +28,21 @@ export default class DocTypeValidator {
         let angleBracketsCount = 1;
         let hasBody = false;
         let comment = false;
+        let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
         let entityCount = 0;
 
         for (; i < xmlData.length; i++) {
+            // Inside a quoted external-identifier literal — '<' and '>' are
+            // plain data here per the XML grammar, not DOCTYPE structure.
+            if (quoteChar !== null) {
+                if (xmlData[i] === quoteChar) quoteChar = null;
+                continue;
+            }
+            if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
+                quoteChar = xmlData[i];
+                continue;
+            }
+
             if (xmlData[i] === '<' && !comment) {
                 if (hasBody && hasSeq(xmlData, '!ENTITY', i)) {
                     i += 7;
@@ -69,7 +81,7 @@ export default class DocTypeValidator {
             }
         }
 
-        if (angleBracketsCount !== 0) {
+        if (quoteChar !== null || angleBracketsCount !== 0) {
             throw new Error(`Unclosed DOCTYPE`);
         }
 

package/src/validators/XmlDeclarationValidator.js

@@ -1,5 +1,93 @@
 'use strict';
 
+import { isWhiteSpace } from '../util.js';
+
+function isWordChar(ch) {
+  return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch === '_';
+}
+
+/**
+ * Walk the `<?xml ... ?>` body once, left to right, pulling out
+ * `name="value"` / `name='value'` pairs (each one preceded by required
+ * whitespace) and collecting everything else as leftover text.
+ *
+ * This replaces two regexes that used to do the same job:
+ *   /\s+([\w]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g          - to find attributes
+ *   /\s+[\w]+\s*=\s*(?:"[^"]*"|'[^']*')/g (via replace)  - to find leftovers
+ *
+ * Both led with a required-but-greedy `\s+`. On a long run of whitespace
+ * that's never followed by a valid `name=value`, the engine backtracks that
+ * whitespace group one character at a time before giving up on that
+ * starting position — and since none of those backtracked attempts can ever
+ * succeed (a whitespace character is never a valid name character, at any
+ * backtrack length), all of that retrying was wasted work. A `<?xml ?>`
+ * declaration padded with thousands of spaces could make this step take
+ * seconds. Scanning forward once, without ever revisiting a position, is
+ * both faster and gives the identical result — the retried attempts could
+ * never have succeeded anyway.
+ *
+ * @param {string} declBody
+ * @returns {{ matches: Array<{name: string, value: string, index: number}>, leftover: string }}
+ */
+function scanDeclAttributes(declBody) {
+  const matches = [];
+  let leftover = '';
+  const len = declBody.length;
+  let i = 0;
+
+  while (i < len) {
+    if (!isWhiteSpace(declBody[i])) {
+      leftover += declBody[i];
+      i++;
+      continue;
+    }
+
+    const matchStart = i;
+    let p = i;
+    while (p < len && isWhiteSpace(declBody[p])) p++;
+
+    const nameStart = p;
+    while (p < len && isWordChar(declBody[p])) p++;
+    if (p === nameStart) {
+      // Whitespace not followed by a name character — can't become a match
+      // no matter how much of the whitespace we consider, so it's leftover.
+      leftover += declBody.slice(matchStart, p + 1 <= len ? p : len);
+      i = p > matchStart ? p : matchStart + 1;
+      continue;
+    }
+    const name = declBody.slice(nameStart, p);
+
+    let q = p;
+    while (q < len && isWhiteSpace(declBody[q])) q++;
+    if (declBody[q] !== '=') {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+    q++; // skip '='
+    while (q < len && isWhiteSpace(declBody[q])) q++;
+
+    const quote = declBody[q];
+    if (quote !== '"' && quote !== "'") {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+    const valueStart = q + 1;
+    const closeIdx = declBody.indexOf(quote, valueStart);
+    if (closeIdx === -1) {
+      leftover += declBody.slice(matchStart, p);
+      i = p;
+      continue;
+    }
+
+    matches.push({ name, value: declBody.slice(valueStart, closeIdx), index: matchStart });
+    i = closeIdx + 1;
+  }
+
+  return { matches, leftover };
+}
+
 /**
  * XmlDeclarationValidator — single responsibility: parse and validate the
  * `<?xml version="..." encoding="..." standalone="..."?>` prolog.
@@ -49,16 +137,15 @@ export default class XmlDeclarationValidator {
     const end = piEnd + 2;
 
     const ALLOWED = ['version', 'encoding', 'standalone'];
-    const attrRe = /\s+([\w]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+    const { matches: declAttrs, leftover } = scanDeclAttributes(declBody);
 
     let version = '1.0';
     let lastAllowedIdx = -1;
-    let match;
 
-    while ((match = attrRe.exec(declBody)) !== null) {
-      const attrName = match[1];
-      const attrValue = match[2] !== undefined ? match[2] : match[3];
-      const attrPos = match.index;
+    for (let m = 0; m < declAttrs.length; m++) {
+      const attrName = declAttrs[m].name;
+      const attrValue = declAttrs[m].value;
+      const attrPos = declAttrs[m].index;
 
       const allowedIdx = ALLOWED.indexOf(attrName);
       if (allowedIdx === -1) {
@@ -91,13 +178,13 @@ export default class XmlDeclarationValidator {
       // encoding: value format validation is out of scope
     }
 
-    const leftover = declBody.replace(/\s+[\w]+\s*=\s*(?:"[^"]*"|'[^']*')/g, '').trim();
-    if (leftover.length > 0) {
+    const trimmedLeftover = leftover.trim();
+    if (trimmedLeftover.length > 0) {
       this._throwError('InvalidXml',
-        'XML declaration contains invalid content: "' + leftover + '".',
+        'XML declaration contains invalid content: "' + trimmedLeftover + '".',
         { line: 1, col: 1 });
     }
 
     return { version, end };
   }
-}
+}