fast-xml-builder - npm Package Compare versions

Comparing version 1.1.4 to 1.1.5

package.json

 {
   "name": "fast-xml-builder",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "Build XML from JSON without C/C++ based libraries",
@@ -5,0 +5,0 @@ "main": "./lib/fxb.cjs",

src/fxb.js

@@ -489,5 +489,9 @@ 'use strict';
   if (this.options.cdataPropName !== false && key === this.options.cdataPropName) {
-    return this.indentate(level) + `<![CDATA[${val}]]>` + this.newLine;
+    const safeVal = String(val).replace(/\]\]>/g, ']]]]><![CDATA[>');
+    return this.indentate(level) + `<![CDATA[${safeVal}]]>` + this.newLine;
   } else if (this.options.commentPropName !== false && key === this.options.commentPropName) {
-    return this.indentate(level) + `<!--${val}-->` + this.newLine;
+    const safeVal = String(val)
+      .replace(/--/g, '- -')   // -- is illegal anywhere in comment content
+      .replace(/-$/, '- ');    // trailing - would form -- with the closing -->
+    return this.indentate(level) + `<!--${safeVal}-->` + this.newLine;
   } else if (key[0] === "?") {//PI tag
@@ -494,0 +498,0 @@ return this.indentate(level) + '<' + key + attrStr + '?' + this.tagEndChar;

src/orderedJs2Xml.js

@@ -85,3 +85,5 @@ import { Expression, Matcher } from 'path-expression-matcher';
             }
-            xmlStr += `<![CDATA[${tagObj[tagName][0][options.textNodeName]}]]>`;
+            const val = tagObj[tagName][0][options.textNodeName];
+            const safeVal = String(val).replace(/\]\]>/g, ']]]]><![CDATA[>');
+            xmlStr += `<![CDATA[${safeVal}]]>`;
             isPreviousElementTag = false;
@@ -91,3 +93,7 @@ matcher.pop();
         } else if (tagName === options.commentPropName) {
-            xmlStr += indentation + `<!--${tagObj[tagName][0][options.textNodeName]}-->`;
+            const val = tagObj[tagName][0][options.textNodeName]
+            const safeVal = String(val)
+                .replace(/--/g, '- -')   // -- is illegal anywhere in comment content
+                .replace(/-$/, '- ');    // trailing - would form -- with the closing -->
+            xmlStr += indentation + `<!--${safeVal}-->`;
             isPreviousElementTag = true;
@@ -294,2 +300,10 @@ matcher.pop();
     return textValue;
+}
+
+function cdataVal(val) {
+
+}
+
+function commentVal(val) {
+
 }

No alert changes

Improved metrics

Total package byte prevSize

156109

0.44%

Lines of code

988

1.44%

No dependency changes