sax 1.4.2 → 1.4.3

package/lib/sax.js

@@ -780,7 +780,7 @@
               XML_NAMESPACE +
               '\n' +
               'Actual: ' +
-              parser.attribValue,
+              parser.attribValue
           )
         } else if (
           local === 'xmlns' &&
@@ -792,7 +792,7 @@
               XMLNS_NAMESPACE +
               '\n' +
               'Actual: ' +
-              parser.attribValue,
+              parser.attribValue
           )
         } else {
           var tag = parser.tag
@@ -834,7 +834,7 @@
       if (tag.prefix && !tag.uri) {
         strictFail(
           parser,
-          'Unbound namespace prefix: ' + JSON.stringify(parser.tagName),
+          'Unbound namespace prefix: ' + JSON.stringify(parser.tagName)
         )
         tag.uri = qn.prefix
       }
@@ -873,7 +873,7 @@
         if (prefix && prefix !== 'xmlns' && !uri) {
           strictFail(
             parser,
-            'Unbound namespace prefix: ' + JSON.stringify(prefix),
+            'Unbound namespace prefix: ' + JSON.stringify(prefix)
           )
           a.uri = prefix
         }
@@ -999,7 +999,12 @@
       }
     }
     entity = entity.replace(/^0+/, '')
-    if (isNaN(num) || numStr.toLowerCase() !== entity) {
+    if (
+      isNaN(num) ||
+      numStr.toLowerCase() !== entity ||
+      num < 0 ||
+      num > 0x10ffff
+    ) {
       strictFail(parser, 'Invalid character entity')
       return '&' + parser.entity + ';'
     }
@@ -1036,7 +1041,7 @@
     if (parser.closed) {
       return error(
         parser,
-        'Cannot write after close. Assign an onready handler.',
+        'Cannot write after close. Assign an onready handler.'
       )
     }
     if (chunk === null) {
@@ -1188,7 +1193,7 @@
             if (parser.doctype || parser.sawRoot) {
               strictFail(
                 parser,
-                'Inappropriately located doctype declaration',
+                'Inappropriately located doctype declaration'
               )
             }
             parser.doctype = ''
@@ -1401,7 +1406,7 @@
           } else {
             strictFail(
               parser,
-              'Forward-slash in opening tag not followed by >',
+              'Forward-slash in opening tag not followed by >'
             )
             parser.state = S.ATTRIB
           }

package/package.json

@@ -2,7 +2,7 @@
   "name": "sax",
   "description": "An evented streaming XML parser in JavaScript",
   "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "main": "lib/sax.js",
   "license": "BlueOak-1.0.0",
   "scripts": {