pocxxeci 0.30.1

package/lib/sax_parser.js

@@ -0,0 +1,38 @@
+const events = require('events');
+
+const bindings = require('./bindings');
+
+const SaxParser = function SaxParser(callbacks) {
+  const parser = new bindings.SaxParser();
+
+  // attach callbacks
+  for (const callback in callbacks) {
+    parser.on(callback, callbacks[callback]);
+  }
+
+  return parser;
+};
+
+// Overriding the prototype, like util.inherit, wipes out the native binding.
+// Copy over the methods instead.
+for (const k in events.EventEmitter.prototype)
+  bindings.SaxParser.prototype[k] = events.EventEmitter.prototype[k];
+
+const SaxPushParser = function SaxPushParser(callbacks) {
+  const parser = new bindings.SaxPushParser();
+
+  // attach callbacks
+  for (const callback in callbacks) {
+    parser.on(callback, callbacks[callback]);
+  }
+
+  return parser;
+};
+
+// Overriding the prototype, like util.inherit, wipes out the native binding.
+// Copy over the methods instead.
+for (const k in events.EventEmitter.prototype)
+  bindings.SaxPushParser.prototype[k] = events.EventEmitter.prototype[k];
+
+module.exports.SaxParser = SaxParser;
+module.exports.SaxPushParser = SaxPushParser;

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "pocxxeci",
+  "author": "marudor",
+  "contributors": [
+    "Jeff Smick",
+    "Marco Rogers"
+  ],
+  "packageManager": "pnpm@6.32.9",
+  "binary": {
+    "module_name": "xmljs",
+    "module_path": "./build/Release/",
+    "host": "https://github.com",
+    "remote_path": "./marudor/libxmljs2/releases/download/v{version}/",
+    "package_name": "{node_abi}-{platform}-{arch}-{libc}.tar.gz"
+  },
+  "description": "libxml bindings for v8 javascript engine",
+  "version": "0.30.1",
+  "scripts": {
+    "build": "node-pre-gyp install --build-from-source",
+    "install": "node-pre-gyp install --fallback-to-build --loglevel http",
+    "test": "node --expose_gc ./node_modules/jest/bin/jest.js",
+    "lint": "eslint index.js test",
+    "tsd": "tsd",
+    "package": "node-pre-gyp package 2>&1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/Antiphishing/test-xxe.git"
+  },
+  "bugs": {
+    "url": "http://github.com/marudor/libxmljs2/issues"
+  },
+  "main": "./index",
+  "license": "MIT",
+  "engines": {
+    "node": ">=12"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "src",
+    "lib",
+    "vendor",
+    "binding.gyp",
+    "Makefile"
+  ],
+  "dependencies": {
+    "@mapbox/node-pre-gyp": "^1.0.9",
+    "bindings": "~1.5.0",
+    "child_process": "^1.0.2",
+    "nan": "~2.15.0",
+    "net": "^1.0.2"
+  },
+  "devDependencies": {
+    "eslint": "^8.14.0",
+    "eslint-config-marudor": "^9.0.0",
+    "jest": "^27.5.1",
+    "jest-watch-typeahead": "^1.0.0",
+    "prettier": "^2.6.2",
+    "tsd": "^0.20.0",
+    "typescript": "^4.6.3"
+  },
+  "types": "./index.d.ts",
+  "homepage": "https://github.com/marudor/libxmljs2#readme",
+  "directories": {
+    "example": "examples",
+    "lib": "lib",
+    "test": "test"
+  }
+}

package/src/html_document.cc

@@ -0,0 +1,7 @@
+// Copyright 2009, Squish Tech, LLC.
+#include "html_document.h"
+
+namespace libxmljs {
+
+void HtmlDocument::Initialize(v8::Local<v8::Object> target) {}
+} // namespace libxmljs

package/src/html_document.h

@@ -0,0 +1,18 @@
+// Copyright 2009, Squish Tech, LLC.
+#ifndef SRC_HTML_DOCUMENT_H_
+#define SRC_HTML_DOCUMENT_H_
+
+#include "libxmljs.h"
+#include "xml_document.h"
+
+namespace libxmljs {
+
+class HtmlDocument : public XmlDocument {
+public:
+  explicit HtmlDocument(xmlDoc *doc) : XmlDocument(doc) {}
+  static void Initialize(v8::Local<v8::Object> target);
+};
+
+} // namespace libxmljs
+
+#endif // SRC_HTML_DOCUMENT_H_

package/src/libxmljs.cc

@@ -0,0 +1,252 @@
+// Copyright 2009, Squish Tech, LLC.
+
+#include <v8.h>
+
+#include <libxml/xmlmemory.h>
+
+#include "libxmljs.h"
+#include "xml_document.h"
+#include "xml_namespace.h"
+#include "xml_node.h"
+#include "xml_sax_parser.h"
+#include "xml_textwriter.h"
+
+using namespace v8;
+namespace libxmljs {
+
+// ensure destruction at exit time
+// v8 doesn't cleanup its resources
+LibXMLJS LibXMLJS::instance;
+
+// track how much memory libxml2 is using
+int xml_memory_used = 0;
+
+// How often we report memory usage changes back to V8.
+const int nan_adjust_external_memory_threshold = 1024 * 1024;
+
+// track how many nodes haven't been freed
+int nodeCount = 0;
+
+void adjustExternalMemory() {
+  const int diff = xmlMemUsed() - xml_memory_used;
+
+  if (abs(diff) > nan_adjust_external_memory_threshold) {
+    xml_memory_used += diff;
+    Nan::AdjustExternalMemory(diff);
+  }
+}
+
+// wrapper for xmlMemMalloc to update v8's knowledge of memory used
+// the GC relies on this information
+void *xmlMemMallocWrap(size_t size) {
+  void *res = xmlMemMalloc(size);
+
+  // no need to udpate memory if we didn't allocate
+  if (!res) {
+    return res;
+  }
+
+  adjustExternalMemory();
+  return res;
+}
+
+// wrapper for xmlMemFree to update v8's knowledge of memory used
+// the GC relies on this information
+void xmlMemFreeWrap(void *p) {
+  xmlMemFree(p);
+
+  // if v8 is no longer running, don't try to adjust memory
+  // this happens when the v8 vm is shutdown and the program is exiting
+  // our cleanup routines for libxml will be called (freeing memory)
+  // but v8 is already offline and does not need to be informed
+  // trying to adjust after shutdown will result in a fatal error
+  if (Isolate::GetCurrent() == 0 || Isolate::GetCurrent()->IsDead()) {
+    return;
+  }
+
+  adjustExternalMemory();
+}
+
+// wrapper for xmlMemRealloc to update v8's knowledge of memory used
+void *xmlMemReallocWrap(void *ptr, size_t size) {
+  void *res = xmlMemRealloc(ptr, size);
+
+  // if realloc fails, no need to update v8 memory state
+  if (!res) {
+    return res;
+  }
+
+  adjustExternalMemory();
+  return res;
+}
+
+// wrapper for xmlMemoryStrdupWrap to update v8's knowledge of memory used
+char *xmlMemoryStrdupWrap(const char *str) {
+  char *res = xmlMemoryStrdup(str);
+
+  // if strdup fails, no need to update v8 memory state
+  if (!res) {
+    return res;
+  }
+
+  adjustExternalMemory();
+  return res;
+}
+
+void deregisterNsList(xmlNs *ns) {
+  while (ns != NULL) {
+    if (ns->_private != NULL) {
+      XmlNamespace *wrapper = static_cast<XmlNamespace *>(ns->_private);
+      wrapper->xml_obj = NULL;
+      ns->_private = NULL;
+    }
+    ns = ns->next;
+  }
+}
+
+void deregisterNodeNamespaces(xmlNode *xml_obj) {
+  xmlNs *ns = NULL;
+  if ((xml_obj->type == XML_DOCUMENT_NODE) ||
+#ifdef LIBXML_DOCB_ENABLED
+      (xml_obj->type == XML_DOCB_DOCUMENT_NODE) ||
+#endif
+      (xml_obj->type == XML_HTML_DOCUMENT_NODE)) {
+    ns = reinterpret_cast<xmlDoc *>(xml_obj)->oldNs;
+  } else if ((xml_obj->type == XML_ELEMENT_NODE) ||
+             (xml_obj->type == XML_XINCLUDE_START) ||
+             (xml_obj->type == XML_XINCLUDE_END)) {
+    ns = xml_obj->nsDef;
+  }
+  if (ns != NULL) {
+    deregisterNsList(ns);
+  }
+}
+
+/*
+ * Before libxmljs nodes are freed, they are passed to the deregistration
+ * callback, (configured by `xmlDeregisterNodeDefault`).
+ *
+ * In deregistering each node, we update any wrapper (e.g. `XmlElement`,
+ * `XmlAttribute`) to ensure that when it is destroyed, it doesn't try to
+ * access the freed memory.
+ *
+ * Because namespaces (`xmlNs`) attached to nodes are also freed and may be
+ * wrapped, it is necessary to update any wrappers (`XmlNamespace`) which have
+ * been created for attached namespaces.
+ */
+void xmlDeregisterNodeCallback(xmlNode *xml_obj) {
+  nodeCount--;
+  deregisterNodeNamespaces(xml_obj);
+  if (xml_obj->_private != NULL) {
+    static_cast<XmlNode *>(xml_obj->_private)->xml_obj = NULL;
+    xml_obj->_private = NULL;
+  }
+  return;
+}
+
+// this is called for any created nodes
+void xmlRegisterNodeCallback(xmlNode *xml_obj) { nodeCount++; }
+
+LibXMLJS::LibXMLJS() {
+  // set the callback for when a node is created
+  xmlRegisterNodeDefault(xmlRegisterNodeCallback);
+
+  // set the callback for when a node is about to be freed
+  xmlDeregisterNodeDefault(xmlDeregisterNodeCallback);
+
+  // populated debugMemSize (see xmlmemory.h/c) and makes the call to
+  // xmlMemUsed work, this must happen first!
+  xmlMemSetup(xmlMemFreeWrap, xmlMemMallocWrap, xmlMemReallocWrap,
+              xmlMemoryStrdupWrap);
+
+  // initialize libxml
+  LIBXML_TEST_VERSION;
+
+  // initial memory usage
+  xml_memory_used = xmlMemUsed();
+}
+
+LibXMLJS::~LibXMLJS() { xmlCleanupParser(); }
+
+Local<Object> listFeatures() {
+  Nan::EscapableHandleScope scope;
+  Local<Object> target = Nan::New<Object>();
+#define FEAT(x)                                                                \
+  Nan::Set(target, Nan::New<String>(#x).ToLocalChecked(),                      \
+           Nan::New<Boolean>(xmlHasFeature(XML_WITH_##x)))
+  // See enum xmlFeature in parser.h
+  FEAT(THREAD);
+  FEAT(TREE);
+  FEAT(OUTPUT);
+  FEAT(PUSH);
+  FEAT(READER);
+  FEAT(PATTERN);
+  FEAT(WRITER);
+  FEAT(SAX1);
+  FEAT(FTP);
+  FEAT(HTTP);
+  FEAT(VALID);
+  FEAT(HTML);
+  FEAT(LEGACY);
+  FEAT(C14N);
+  FEAT(CATALOG);
+  FEAT(XPATH);
+  FEAT(XPTR);
+  FEAT(XINCLUDE);
+  FEAT(ICONV);
+  FEAT(ISO8859X);
+  FEAT(UNICODE);
+  FEAT(REGEXP);
+  FEAT(AUTOMATA);
+  FEAT(EXPR);
+  FEAT(SCHEMAS);
+  FEAT(SCHEMATRON);
+  FEAT(MODULES);
+  FEAT(DEBUG);
+  FEAT(DEBUG_MEM);
+  FEAT(DEBUG_RUN);
+  FEAT(ZLIB);
+  FEAT(ICU);
+  FEAT(LZMA);
+  return scope.Escape(target);
+}
+
+NAN_METHOD(XmlMemUsed) {
+  Nan::HandleScope scope;
+  return info.GetReturnValue().Set(Nan::New<Int32>(xmlMemUsed()));
+}
+
+NAN_METHOD(XmlNodeCount) {
+  Nan::HandleScope scope;
+  return info.GetReturnValue().Set(Nan::New<Int32>(nodeCount));
+}
+
+NAN_MODULE_INIT(init) {
+  Nan::HandleScope scope;
+
+  XmlDocument::Initialize(target);
+  XmlSaxParser::Initialize(target);
+  XmlTextWriter::Initialize(target);
+
+  Nan::Set(target, Nan::New<String>("libxml_version").ToLocalChecked(),
+           Nan::New<String>(LIBXML_DOTTED_VERSION).ToLocalChecked());
+
+  Nan::Set(target, Nan::New<String>("libxml_parser_version").ToLocalChecked(),
+           Nan::New<String>(xmlParserVersion).ToLocalChecked());
+
+  Nan::Set(target, Nan::New<String>("libxml_debug_enabled").ToLocalChecked(),
+           Nan::New<Boolean>(debugging));
+
+  Nan::Set(target, Nan::New<String>("features").ToLocalChecked(),
+           listFeatures());
+
+  Nan::Set(target, Nan::New<String>("libxml").ToLocalChecked(), target);
+
+  Nan::SetMethod(target, "xmlMemUsed", XmlMemUsed);
+
+  Nan::SetMethod(target, "xmlNodeCount", XmlNodeCount);
+}
+
+NODE_MODULE(xmljs, init)
+
+} // namespace libxmljs

package/src/libxmljs.h

@@ -0,0 +1,53 @@
+// Copyright 2009, Squish Tech, LLC.
+#ifndef SRC_LIBXMLJS_H_
+#define SRC_LIBXMLJS_H_
+
+#include "nan.h"
+#include <node.h>
+#include <v8.h>
+
+#define LIBXMLJS_ARGUMENT_TYPE_CHECK(arg, type, err)                           \
+  if (!arg->type()) {                                                          \
+    return Nan::ThrowTypeError(err);                                           \
+  }
+
+#define NAN_CONSTRUCTOR_CHECK(name)                                            \
+  if (!info.IsConstructCall()) {                                               \
+    Nan::ThrowTypeError("Class constructor " #name                             \
+                        " cannot be invoked without 'new'");                   \
+    return;                                                                    \
+  }
+
+#define DOCUMENT_ARG_CHECK                                                     \
+  if (info.Length() == 0 || info[0]->IsNullOrUndefined()) {                    \
+    Nan::ThrowError("document argument required");                             \
+    return;                                                                    \
+  }                                                                            \
+  Local<Object> doc = Nan::To<Object>(info[0]).ToLocalChecked();               \
+  if (!XmlDocument::constructor_template.Get(Isolate::GetCurrent())            \
+           ->HasInstance(doc)) {                                               \
+    Nan::ThrowError("document argument must be an instance of Document");      \
+    return;                                                                    \
+  }
+
+namespace libxmljs {
+
+#ifdef LIBXML_DEBUG_ENABLED
+static const bool debugging = true;
+#else
+static const bool debugging = false;
+#endif
+
+// Ensure that libxml is properly initialised and destructed at shutdown
+class LibXMLJS {
+public:
+  LibXMLJS();
+  virtual ~LibXMLJS();
+
+private:
+  static LibXMLJS instance;
+};
+
+} // namespace libxmljs
+
+#endif // SRC_LIBXMLJS_H_

package/src/xml_attribute.cc

@@ -0,0 +1,173 @@
+// Copyright 2009, Squish Tech, LLC.
+#include "xml_attribute.h"
+
+using namespace v8;
+namespace libxmljs {
+
+Nan::Persistent<FunctionTemplate> XmlAttribute::constructor_template;
+
+NAN_METHOD(XmlAttribute::New) {
+  Nan::HandleScope scope;
+
+  return info.GetReturnValue().Set(info.Holder());
+}
+
+Local<Object> XmlAttribute::New(xmlNode *xml_obj, const xmlChar *name,
+                                const xmlChar *value) {
+  Nan::EscapableHandleScope scope;
+  xmlAttr *attr = xmlSetProp(xml_obj, name, value);
+  assert(attr);
+
+  if (attr->_private) {
+    return scope.Escape(static_cast<XmlNode *>(xml_obj->_private)->handle());
+  }
+
+  XmlAttribute *attribute = new XmlAttribute(attr);
+  Local<Object> obj =
+      Nan::NewInstance(
+          Nan::GetFunction(Nan::New(constructor_template)).ToLocalChecked())
+          .ToLocalChecked();
+  attribute->Wrap(obj);
+  return scope.Escape(obj);
+}
+
+Local<Object> XmlAttribute::New(xmlAttr *attr) {
+  Nan::EscapableHandleScope scope;
+  assert(attr->type == XML_ATTRIBUTE_NODE);
+
+  if (attr->_private) {
+    return scope.Escape(static_cast<XmlNode *>(attr->_private)->handle());
+  }
+
+  XmlAttribute *attribute = new XmlAttribute(attr);
+  Local<Object> obj =
+      Nan::NewInstance(
+          Nan::GetFunction(Nan::New(constructor_template)).ToLocalChecked())
+          .ToLocalChecked();
+  attribute->Wrap(obj);
+  return scope.Escape(obj);
+}
+
+NAN_METHOD(XmlAttribute::Name) {
+  Nan::HandleScope scope;
+  XmlAttribute *attr = Nan::ObjectWrap::Unwrap<XmlAttribute>(info.Holder());
+  assert(attr);
+
+  return info.GetReturnValue().Set(attr->get_name());
+}
+
+NAN_METHOD(XmlAttribute::Value) {
+  Nan::HandleScope scope;
+  XmlAttribute *attr = Nan::ObjectWrap::Unwrap<XmlAttribute>(info.Holder());
+  assert(attr);
+
+  // attr.value('new value');
+  if (info.Length() > 0) {
+    attr->set_value(*Nan::Utf8String(info[0]));
+    return info.GetReturnValue().Set(info.Holder());
+  }
+
+  // attr.value();
+  return info.GetReturnValue().Set(attr->get_value());
+}
+
+NAN_METHOD(XmlAttribute::Node) {
+  Nan::HandleScope scope;
+  XmlAttribute *attr = Nan::ObjectWrap::Unwrap<XmlAttribute>(info.Holder());
+  assert(attr);
+
+  return info.GetReturnValue().Set(attr->get_element());
+}
+
+NAN_METHOD(XmlAttribute::Namespace) {
+  Nan::HandleScope scope;
+  XmlAttribute *attr = Nan::ObjectWrap::Unwrap<XmlAttribute>(info.Holder());
+  assert(attr);
+
+  return info.GetReturnValue().Set(attr->get_namespace());
+}
+
+Local<Value> XmlAttribute::get_name() {
+  Nan::EscapableHandleScope scope;
+  if (xml_obj->name)
+    return scope.Escape(
+        Nan::New<String>((const char *)xml_obj->name, xmlStrlen(xml_obj->name))
+            .ToLocalChecked());
+
+  return scope.Escape(Nan::Null());
+}
+
+Local<Value> XmlAttribute::get_value() {
+  Nan::EscapableHandleScope scope;
+  xmlChar *value = xmlNodeGetContent(xml_obj);
+  if (value != NULL) {
+    Local<String> ret_value =
+        Nan::New<String>((const char *)value, xmlStrlen(value))
+            .ToLocalChecked();
+    xmlFree(value);
+    return scope.Escape(ret_value);
+  }
+
+  return scope.Escape(Nan::Null());
+}
+
+void XmlAttribute::set_value(const char *value) {
+  if (xml_obj->children)
+    xmlFreeNodeList(xml_obj->children);
+
+  xml_obj->children = xml_obj->last = NULL;
+
+  if (value) {
+    xmlChar *buffer;
+    xmlNode *tmp;
+
+    // Encode our content
+    buffer = xmlEncodeEntitiesReentrant(xml_obj->doc, (const xmlChar *)value);
+
+    xml_obj->children = xmlStringGetNodeList(xml_obj->doc, buffer);
+    xml_obj->last = NULL;
+    tmp = xml_obj->children;
+
+    // Loop through the children
+    for (tmp = xml_obj->children; tmp; tmp = tmp->next) {
+      tmp->parent = reinterpret_cast<xmlNode *>(xml_obj);
+      tmp->doc = xml_obj->doc;
+      if (tmp->next == NULL)
+        xml_obj->last = tmp;
+    }
+
+    // Free up memory
+    xmlFree(buffer);
+  }
+}
+
+Local<Value> XmlAttribute::get_element() {
+  Nan::EscapableHandleScope scope;
+  return scope.Escape(XmlElement::New(xml_obj->parent));
+}
+
+Local<Value> XmlAttribute::get_namespace() {
+  Nan::EscapableHandleScope scope;
+  if (!xml_obj->ns) {
+    return scope.Escape(Nan::Null());
+  }
+  return scope.Escape(XmlNamespace::New(xml_obj->ns));
+}
+
+void XmlAttribute::Initialize(Local<Object> target) {
+  Nan::HandleScope scope;
+  Local<FunctionTemplate> tmpl = Nan::New<FunctionTemplate>(XmlAttribute::New);
+  constructor_template.Reset(tmpl);
+  tmpl->Inherit(Nan::New(XmlNode::constructor_template));
+  tmpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+  Nan::SetPrototypeMethod(tmpl, "name", XmlAttribute::Name);
+  Nan::SetPrototypeMethod(tmpl, "value", XmlAttribute::Value);
+  Nan::SetPrototypeMethod(tmpl, "node", XmlAttribute::Node);
+  Nan::SetPrototypeMethod(tmpl, "namespace", XmlAttribute::Namespace);
+
+  Nan::Set(target, Nan::New<String>("Attribute").ToLocalChecked(),
+           Nan::GetFunction(tmpl).ToLocalChecked());
+}
+
+} // namespace libxmljs

package/src/xml_attribute.h

@@ -0,0 +1,40 @@
+// Copyright 2009, Squish Tech, LLC.
+#ifndef SRC_XML_ATTRIBUTE_H_
+#define SRC_XML_ATTRIBUTE_H_
+
+#include "libxmljs.h"
+#include "xml_element.h"
+#include "xml_namespace.h"
+
+namespace libxmljs {
+
+class XmlAttribute : public XmlNode {
+public:
+  explicit XmlAttribute(xmlAttr *node)
+      : XmlNode(reinterpret_cast<xmlNode *>(node)) {}
+
+  static void Initialize(v8::Local<v8::Object> target);
+  static Nan::Persistent<v8::FunctionTemplate> constructor_template;
+
+  static v8::Local<v8::Object> New(xmlNode *xml_obj, const xmlChar *name,
+                                   const xmlChar *value);
+
+  static v8::Local<v8::Object> New(xmlAttr *attr);
+
+protected:
+  static NAN_METHOD(New);
+  static NAN_METHOD(Name);
+  static NAN_METHOD(Value);
+  static NAN_METHOD(Node);
+  static NAN_METHOD(Namespace);
+
+  v8::Local<v8::Value> get_name();
+  v8::Local<v8::Value> get_value();
+  void set_value(const char *value);
+  v8::Local<v8::Value> get_element();
+  v8::Local<v8::Value> get_namespace();
+};
+
+} // namespace libxmljs
+
+#endif // SRC_XML_ATTRIBUTE_H_