Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Merge pull request from GHSA-h6q6-9hqw-rwfv
* fix!: Preserve quotes in DOCTYPE declaration Since the only purpose of parsing the DOCTYPE is to be able to restore it when serializing, we decided that it would be best to leave the parsed publicId and systemId as is, including any quotes. BREAKING CHANGE: If somebody relies on the actual unquoted values of those ids, they will need to take care of either single or double quotes and the right escaping. (Without this change this would not have been possible because the SAX parser already dropped the information about the quotes that have been used in the source.) https://www.w3.org/TR/2006/REC-xml11-20060816/#dtd https://www.w3.org/TR/2006/REC-xml11-20060816/#IDAX1KS (External Entity Declaration) Co-authored-by: Christian Bewernitz <coder@karfau.de> Co-authored-by: Chris Brody <chris.brody+brodybits@gmail.com> * feat(security): Improve error reporting; throw on duplicate attribute BREAKING CHANGE: It is currently not clear how to consistently deal with duplicate attributes, so it is also safer for our users to fail when detecting them. It is possible to configure the `DOMParser.errorHandler` before parsing, to handle those errors differently. To accomplish this and also be able to verify it in tests we needed to: - create a new `Error` type `ParseError` and export it - Throw `ParseError` from `errorHandler.fatalError` and prevent those from being caught in `XMLReader`. - export `DOMHandler` constructor as `__DOMHandler` Co-authored-by: Christian Bewernitz <coder@karfau.de> Co-authored-by: Chris Brody <chris.brody+brodybits@gmail.com> Co-authored-by: Christian Bewernitz <coder@karfau.de>
- Loading branch information
Showing
14 changed files
with
1,190 additions
and
134 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.