xslt-processor 4.8.5 → 4.9.0

package/README.md

@@ -4,7 +4,7 @@ _A JavaScript XSLT processor without native library dependencies._
 
   <p align="center">
     <a href="https://github.com/DesignLiquido/xslt-processor/issues" target="_blank">
-      <img src="https://img.shields.io/github/issues/Designliquido/xslt-processor" />
+      <img src="https://img.shields.io/github/issues/DesignLiquido/xslt-processor" />
     </a>
     <img src="https://img.shields.io/github/stars/Designliquido/xslt-processor" />
     <img src="https://img.shields.io/github/forks/Designliquido/xslt-processor" />
@@ -37,7 +37,7 @@ ohpm install xslt-processor
 yarn add xslt-processor
 ```
 
-Within your ES2015+ code, import the `Xslt` class, the `XmlParser` class and use this way:
+Within your ES2015+ code, import the `Xslt` class, the `XmlParser` class and use it this way:
 
 ```js
 import { Xslt, XmlParser } from 'xslt-processor'
@@ -80,11 +80,44 @@ const xslt = new Xslt(options);
 - `cData` (`boolean`, default `true`): resolves CDATA elements in the output. Content under CDATA is resolved as text. This overrides `escape` for CDATA content.
 - `escape` (`boolean`, default `true`): replaces symbols like `<`, `>`, `&` and `"` by the corresponding [HTML/XML entities](https://www.tutorialspoint.com/xml/xml_character_entities.htm). Can be overridden by `disable-output-escaping`, that also does the opposite, unescaping `&gt;` and `&lt;` by `<` and `>`, respectively.
 - `selfClosingTags` (`boolean`, default `true`): Self-closes tags that don't have inner elements, if `true`. For instance, `<test></test>` becomes `<test />`.
-- `outputMethod` (`string`, default `xml`): Specifies the default output method. if `<xsl:output>` is declared in your XSLT file, this will be overridden. Valid values: `xml`, `html`, `text`, `name`, `xhtml`, `json`, `adaptive`.
+- `outputMethod` (`string`, default `xml`): Specifies the default output method. If `<xsl:output>` is declared in your XSLT file, this will be overridden. Valid values: `xml`, `html`, `text`, `xhtml`, `json`, `adaptive`.
 - `parameters` (`array`, default `[]`): external parameters that you want to use.
     - `name`: the parameter name;
     - `namespaceUri` (optional): the namespace;
     - `value`: the value.
+- `fetchFunction` (`(uri: string) => Promise<string>`, optional): a custom function for loading external resources referenced by `<xsl:import>` and `<xsl:include>`. Receives the URI and must return the fetched content as a string. Defaults to the global `fetch` API. This is useful for:
+    - Denying external loading entirely;
+    - Loading from the local filesystem or other non-HTTP sources;
+    - Transforming or remapping URIs before fetching.
+
+**`fetchFunction` examples:**
+
+```js
+import { readFileSync } from 'fs';
+
+// Deny all external loading
+const xslt = new Xslt({
+  fetchFunction: async (uri) => {
+    throw new Error(`External loading is not allowed: ${uri}`);
+  }
+});
+
+// Load from local filesystem
+const xslt = new Xslt({
+  fetchFunction: async (uri) => {
+    return readFileSync(uri, 'utf-8');
+  }
+});
+
+// Remap URIs before fetching
+const xslt = new Xslt({
+  fetchFunction: async (uri) => {
+    const remapped = uri.replace('https://example.com/', '/local/stylesheets/');
+    const response = await fetch(remapped);
+    return response.text();
+  }
+});
+```
 
 #### JSON Output Format
 
@@ -182,10 +215,10 @@ console.log(result2); // "<users><user>John</user></users>" (XML)
 You can simply add a tag like this:
 
 ```html
-<script type="application/javascript" src="https://www.unpkg.com/xslt-processor@latest/umd/xslt-processor.global.js"></script>
+<script type="application/javascript" src="https://unpkg.com/xslt-processor@latest/umd/xslt-processor.global.js"></script>
 ```
 
-All the exports will live under `globalThis.XsltProcessor` and `window.XsltProcessor`. [See a usage example here](https://github.com/DesignLiquido/xslt-processor/blob/main/interactive-tests/xslt.html). 
+All the exports will live under `globalThis.XsltProcessor` and `window.XsltProcessor`. [See a usage example here](https://github.com/DesignLiquido/xslt-processor/blob/main/interactive-tests/xslt.html).
 
 ## XPath Parser
 
@@ -204,7 +237,7 @@ import { XPath } from 'xslt-processor'
 const xPath = new XPath();
 ```
 
-`XPath` class is an external dependency, [living in its own repository](https://github.com/DesignLiquido/xpath). 
+`XPath` class is an external dependency, [living in its own repository](https://github.com/DesignLiquido/xpath).
 
 ## Introduction
 
@@ -215,13 +248,40 @@ XSLT-processor builds on Google's [AJAXSLT](https://github.com/4031651/ajaxslt)
 
 This implementation of XSLT operates at the DOM level on its input documents. It internally uses a DOM implementation to create the output document, but usually returns the output document as text stream. The DOM to construct the output document can be supplied by the application, or else an internal minimal DOM implementation is used. This DOM comes with a minimal XML parser that can be used to generate a suitable DOM representation of the input documents if they are present as text.
 
+## Building from source
+
+The XPath engine lives in a Git submodule at `src/xpath/lib`. A regular `git clone` does **not** fetch it automatically, so the build will fail unless the submodule is initialised.
+
+### Fresh clone
+
+```sh
+git clone --recurse-submodules https://github.com/DesignLiquido/xslt-processor.git
+cd xslt-processor
+yarn install
+yarn build
+```
+
+### Already cloned without submodules
+
+```sh
+git submodule update --init --recursive
+yarn install
+yarn build
+```
+
+### Updating the submodule to the latest commit
+
+```sh
+git submodule update --remote src/xpath/lib
+```
+
 ## Tests and usage examples
 
-New tests are written in Jest an can be run by calling: `yarn test`.
+New tests are written in Jest and can be run by calling: `yarn test`.
 
 The files `xslt.html` and `xpath.html` in the directory `interactive-tests` are interactive tests. They can be run directly from the file system; no HTTP server is needed.
 
-Both interactive tests and automatic tests demonstrate the use of the library functions. 
+Both interactive tests and automatic tests demonstrate the use of the library functions.
 
 ## Conformance
 
@@ -233,9 +293,9 @@ So far, we have implemented XQuery functions for versions 1.0 and 2.0, but this
 
 The DOM implementation is minimal so as to support the XSLT processing, and not intended to be complete.
 
-The implementation is all agnostic about namespaces. It just expects XSLT elements to have tags that carry the `xsl:` prefix, but we disregard all namespace declaration for them.
+The implementation is all agnostic about namespaces. It just expects XSLT elements to have tags that carry the `xsl:` prefix, but we disregard all namespace declarations for them.
 
-[There are a few nonstandard XPath functions](https://github.com/search?q=repo%3ADesignLiquido%2Fxslt-processor%20ext-&type=code). 
+[There are a few nonstandard XPath functions](https://github.com/search?q=repo%3ADesignLiquido%2Fxslt-processor%20ext-&type=code).
 
 ### HTML Conformance
 

package/index.d.mts

@@ -172,6 +172,7 @@ type XsltOptions = {
     selfClosingTags: boolean;
     outputMethod?: 'xml' | 'html' | 'text' | 'xhtml' | 'json' | 'adaptive';
     parameters?: XsltParameter[];
+    fetchFunction?: (uri: string) => Promise<string>;
 };
 
 interface NodeValue {
@@ -760,6 +761,12 @@ declare class Xslt {
     options: XsltOptions;
     decimalFormatSettings: XsltDecimalFormatSettings;
     warningsCallback: (...args: any[]) => void;
+    /**
+     * Custom fetch function for loading external resources (e.g. xsl:import, xsl:include).
+     * Takes a URI and returns the fetched content as a string.
+     * Defaults to using the global `fetch` API.
+     */
+    fetchFunction: (uri: string) => Promise<string>;
     outputDocument: XDocument;
     outputMethod: 'xml' | 'html' | 'text' | 'name' | 'xhtml' | 'json' | 'adaptive';
     outputOmitXmlDeclaration: string;

package/index.d.ts

@@ -172,6 +172,7 @@ type XsltOptions = {
     selfClosingTags: boolean;
     outputMethod?: 'xml' | 'html' | 'text' | 'xhtml' | 'json' | 'adaptive';
     parameters?: XsltParameter[];
+    fetchFunction?: (uri: string) => Promise<string>;
 };
 
 interface NodeValue {
@@ -760,6 +761,12 @@ declare class Xslt {
     options: XsltOptions;
     decimalFormatSettings: XsltDecimalFormatSettings;
     warningsCallback: (...args: any[]) => void;
+    /**
+     * Custom fetch function for loading external resources (e.g. xsl:import, xsl:include).
+     * Takes a URI and returns the fetched content as a string.
+     * Defaults to using the global `fetch` API.
+     */
+    fetchFunction: (uri: string) => Promise<string>;
     outputDocument: XDocument;
     outputMethod: 'xml' | 'html' | 'text' | 'name' | 'xhtml' | 'json' | 'adaptive';
     outputOmitXmlDeclaration: string;

package/index.js

@@ -10973,7 +10973,7 @@ function xmlElementLogicTrivial(node, buffer, options) {
     if (!attribute) {
       continue;
     }
-    if (options.outputMethod === "html" && (attribute.nodeName === "xmlns" || attribute.nodeName.startsWith("xmlns:"))) {
+    if (options.outputMethod === "html" && attribute.nodeName === "xmlns" && attribute.nodeValue === "http://www.w3.org/1999/xhtml") {
       continue;
     }
     if (attribute.nodeName && attribute.nodeValue !== null && attribute.nodeValue !== void 0) {
@@ -13908,6 +13908,16 @@ var Xslt = class {
     this.firstTemplateRan = false;
     this.forwardsCompatible = false;
     this.warningsCallback = console.warn.bind(console);
+    this.fetchFunction = options.fetchFunction || ((uri) => __async(this, null, function* () {
+      const globalFetch = typeof globalThis !== "undefined" && typeof globalThis.fetch === "function" ? globalThis.fetch : null;
+      if (!globalFetch) {
+        throw new Error(
+          "No global fetch implementation available. Please provide options.fetchFunction or use a runtime that exposes globalThis.fetch."
+        );
+      }
+      const response = yield globalFetch(uri);
+      return response.text();
+    }));
     this.streamingProcessor = new StreamingProcessor({
       xPath: this.xPath,
       version: ""
@@ -14572,6 +14582,19 @@ var Xslt = class {
       const value = xmlValueLegacyBehavior(documentFragment);
       if (output) {
         domSetAttribute(output, name, value);
+        if (name.includes(":")) {
+          const prefix = name.split(":")[0];
+          if (prefix !== "xmlns") {
+            const explicitNs = xmlGetAttribute(template, "namespace");
+            const nsUri = explicitNs || this.resolveNamespaceUriForPrefix(template, prefix);
+            if (nsUri) {
+              const nsAttr = `xmlns:${prefix}`;
+              if (!this.isNamespaceDeclaredOnAncestor(output, nsAttr, nsUri)) {
+                domSetAttribute(output, nsAttr, nsUri);
+              }
+            }
+          }
+        }
       }
     });
   }
@@ -14674,6 +14697,12 @@ var Xslt = class {
       domAppendChild(destination, node);
     } else if (source.nodeType == DOM_ATTRIBUTE_NODE) {
       domSetAttribute(destination, source.nodeName, source.nodeValue);
+      if (source.prefix && source.namespaceUri && source.prefix !== "xmlns" && !source.nodeName.startsWith("xmlns")) {
+        const nsAttr = `xmlns:${source.prefix}`;
+        if (!this.isNamespaceDeclaredOnAncestor(destination, nsAttr, source.namespaceUri)) {
+          domSetAttribute(destination, nsAttr, source.namespaceUri);
+        }
+      }
     }
     return null;
   }
@@ -15341,16 +15370,6 @@ var Xslt = class {
   xsltImportOrInclude(context, template, output, isImport) {
     return __async(this, null, function* () {
       const elementName = isImport ? "xsl:import" : "xsl:include";
-      const [major, minor] = process.versions.node.split(".").map(Number);
-      if (major <= 17 && minor < 5) {
-        throw new Error(`Your Node.js version does not support \`<${elementName}>\`. If possible, please update your Node.js version to at least version 17.5.0.`);
-      }
-      if (!global.globalThis.fetch) {
-        global.globalThis.fetch = fetch;
-        global.globalThis.Headers = Headers;
-        global.globalThis.Request = Request;
-        global.globalThis.Response = Response;
-      }
       const hrefAttributeFind = template.childNodes.filter((n) => n.nodeName === "href");
       if (hrefAttributeFind.length <= 0) {
         throw new Error(`<${elementName}> with no href attribute defined.`);
@@ -15360,8 +15379,7 @@ var Xslt = class {
       if (this.importedStylesheets.has(href)) {
         return;
       }
-      const fetchTest = yield global.globalThis.fetch(href);
-      const fetchResponse = yield fetchTest.text();
+      const fetchResponse = yield this.fetchFunction(href);
       const includedXslt = this.xmlParser.xmlParse(fetchResponse);
       const currentDepth = this.styleSheetStack.length > 0 ? this.styleSheetStack[this.styleSheetStack.length - 1].importDepth : 0;
       const metadata = {
@@ -17608,6 +17626,12 @@ var Xslt = class {
             const name = attribute.nodeName;
             const value = this.xsltAttributeValue(attribute.nodeValue, elementContext);
             domSetAttribute(newNode, name, value);
+            if (attribute.prefix && attribute.namespaceUri && attribute.prefix !== "xmlns" && !attribute.nodeName.startsWith("xmlns")) {
+              const nsAttr = `xmlns:${attribute.prefix}`;
+              if (!this.isNamespaceDeclaredOnAncestor(newNode, nsAttr, attribute.namespaceUri)) {
+                domSetAttribute(newNode, nsAttr, attribute.namespaceUri);
+              }
+            }
           }
           break;
         default: