fast-xml-parser - npm Package Compare versions

Comparing version 4.5.4 to 4.5.5

package.json

 {
   "name": "fast-xml-parser",
-  "version": "4.5.4",
+  "version": "4.5.5",
   "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries",
@@ -5,0 +5,0 @@ "main": "./src/fxp.js",

src/fxp.d.ts

@@ -38,2 +38,9 @@ export type ProcessEntitiesOptions = {
   /**
+   * Maximum number of entities allowed in the XML
+   * 
+   * Defaults to `100`
+   */
+  maxEntityCount?: number;
+
+  /**
    * Array of tag names where entity replacement is allowed.
@@ -296,2 +303,12 @@ * If null, entities are replaced in all tags.
   strictReservedNames?: boolean;
+
+  /**
+   * Function to sanitize dangerous property names
+   * 
+   * @param name - The name of the property
+   * @returns {string} The sanitized name
+   * 
+   * Defaults to `(name) => __name`
+   */
+  onDangerousProperty?: (name: string) => string;
 };
@@ -474,2 +491,9 @@
   oneListGroup?: boolean;
+
+  /**
+ * Maximum number of nested tags
+ * 
+ * Defaults to `100`
+ */
+  maxNestedTags?: number;
 };
@@ -476,0 +500,0 @@

src/util.js

@@ -8,3 +8,3 @@ 'use strict';
 
-const getAllMatches = function(string, regex) {
+const getAllMatches = function (string, regex) {
   const matches = [];
@@ -25,3 +25,3 @@ let match = regex.exec(string);
 
-const isName = function(string) {
+const isName = function (string) {
   const match = regexName.exec(string);
@@ -31,7 +31,7 @@ return !(match === null || typeof match === 'undefined');
 
-exports.isExist = function(v) {
+exports.isExist = function (v) {
   return typeof v !== 'undefined';
 };
 
-exports.isEmptyObject = function(obj) {
+exports.isEmptyObject = function (obj) {
   return Object.keys(obj).length === 0;
@@ -45,3 +45,3 @@ };
  */
-exports.merge = function(target, a, arrayMode) {
+exports.merge = function (target, a, arrayMode) {
   if (a) {
@@ -52,3 +52,3 @@ const keys = Object.keys(a); // will return an array of own properties
       if (arrayMode === 'strict') {
-        target[keys[i]] = [ a[keys[i]] ];
+        target[keys[i]] = [a[keys[i]]];
       } else {
@@ -64,3 +64,3 @@ target[keys[i]] = a[keys[i]];
 
-exports.getValue = function(v) {
+exports.getValue = function (v) {
   if (exports.isExist(v)) {
@@ -73,7 +73,24 @@ return v;
 
-// const fakeCall = function(a) {return a;};
-// const fakeCallNoReturn = function() {};
+/**
+ * Dangerous property names that could lead to prototype pollution or security issues
+ */
+const DANGEROUS_PROPERTY_NAMES = [
+  // '__proto__',
+  // 'constructor',
+  // 'prototype',
+  'hasOwnProperty',
+  'toString',
+  'valueOf',
+  '__defineGetter__',
+  '__defineSetter__',
+  '__lookupGetter__',
+  '__lookupSetter__'
+];
 
+const criticalProperties = ["__proto__", "constructor", "prototype"];
+
 exports.isName = isName;
 exports.getAllMatches = getAllMatches;
 exports.nameRegexp = nameRegexp;
+exports.DANGEROUS_PROPERTY_NAMES = DANGEROUS_PROPERTY_NAMES;
+exports.criticalProperties = criticalProperties;

src/xmlparser/DocTypeReader.js

@@ -11,2 +11,3 @@ const util = require('../util');
         const entities = Object.create(null);
+        let entityCount = 0;
 
@@ -32,3 +33,11 @@ if (xmlData[i + 3] === 'O' &&
                         if (val.indexOf("&") === -1) { //Parameter entities are not supported
-                            const escaped = entityName.replace(/[.\-+*:]/g, '\\.');
+                            if (this.options.enabled !== false &&
+                                this.options.maxEntityCount != null &&
+                                entityCount >= this.options.maxEntityCount) {
+                                throw new Error(
+                                    `Entity count (${entityCount + 1}) exceeds maximum allowed (${this.options.maxEntityCount})`
+                                );
+                            }
+                            //const escaped = entityName.replace(/[.\-+*:]/g, '\\.');
+                            const escaped = entityName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
                             entities[entityName] = {
@@ -38,2 +47,3 @@ regx: RegExp(`&${escaped};`, "g"),
                             };
+                            entityCount++;
                         }
@@ -128,3 +138,3 @@ } else if (hasBody && hasSeq(xmlData, "!ELEMENT", i)) {
         if (this.options.enabled !== false &&
-            this.options.maxEntitySize &&
+            this.options.maxEntitySize != null &&
             entityValue.length > this.options.maxEntitySize) {
@@ -131,0 +141,0 @@ throw new Error(

src/xmlparser/OptionsBuilder.js

 
+const { DANGEROUS_PROPERTY_NAMES, criticalProperties } = require("../util");
+
+const defaultOnDangerousProperty = (name) => {
+  if (DANGEROUS_PROPERTY_NAMES.includes(name)) {
+    return "__" + name;
+  }
+  return name;
+};
 const defaultOptions = {
@@ -44,4 +52,29 @@ preserveOrder: false,
   strictReservedNames: true,
+  onDangerousProperty: defaultOnDangerousProperty
 };
+/**
+ * Validates that a property name is safe to use
+ * @param {string} propertyName - The property name to validate
+ * @param {string} optionName - The option field name (for error message)
+ * @throws {Error} If property name is dangerous
+ */
+function validatePropertyName(propertyName, optionName) {
+  if (typeof propertyName !== 'string') {
+    return; // Only validate string property names
+  }
 
+  const normalized = propertyName.toLowerCase();
+  if (DANGEROUS_PROPERTY_NAMES.some(dangerous => normalized === dangerous.toLowerCase())) {
+    throw new Error(
+      `[SECURITY] Invalid ${optionName}: "${propertyName}" is a reserved JavaScript keyword that could cause prototype pollution`
+    );
+  }
+
+  if (criticalProperties.some(dangerous => normalized === dangerous.toLowerCase())) {
+    throw new Error(
+      `[SECURITY] Invalid ${optionName}: "${propertyName}" is a reserved JavaScript keyword that could cause prototype pollution`
+    );
+  }
+}
+
 /**
@@ -69,7 +102,8 @@ * Normalizes processEntities option for backward compatibility
     return {
-      enabled: value.enabled !== false, // default true if not specified
-      maxEntitySize: value.maxEntitySize ?? 10000,
-      maxExpansionDepth: value.maxExpansionDepth ?? 10,
-      maxTotalExpansions: value.maxTotalExpansions ?? 1000,
-      maxExpandedLength: value.maxExpandedLength ?? 100000,
+      enabled: value.enabled !== false,
+      maxEntitySize: Math.max(1, value.maxEntitySize ?? 10000),
+      maxExpansionDepth: Math.max(1, value.maxExpansionDepth ?? 10),
+      maxTotalExpansions: Math.max(1, value.maxTotalExpansions ?? 1000),
+      maxExpandedLength: Math.max(1, value.maxExpandedLength ?? 100000),
+      maxEntityCount: Math.max(1, value.maxEntityCount ?? 100),
       allowedTags: value.allowedTags ?? null,
@@ -87,2 +121,22 @@ tagFilter: value.tagFilter ?? null
 
+
+  // Validate property names to prevent prototype pollution
+  const propertyNameOptions = [
+    { value: built.attributeNamePrefix, name: 'attributeNamePrefix' },
+    { value: built.attributesGroupName, name: 'attributesGroupName' },
+    { value: built.textNodeName, name: 'textNodeName' },
+    { value: built.cdataPropName, name: 'cdataPropName' },
+    { value: built.commentPropName, name: 'commentPropName' }
+  ];
+
+  for (const { value, name } of propertyNameOptions) {
+    if (value) {
+      validatePropertyName(value, name);
+    }
+  }
+
+  if (built.onDangerousProperty === null) {
+    built.onDangerousProperty = defaultOnDangerousProperty;
+  }
+
   // Always normalize processEntities for backward compatibility and validation
@@ -89,0 +143,0 @@ built.processEntities = normalizeProcessEntities(built.processEntities);

src/xmlparser/OrderedObjParser.js

@@ -165,3 +165,3 @@ 'use strict';
         }
-        if (aName === "__proto__") aName = "#__proto__";
+        aName = sanitizeName(aName, this.options);
         if (oldVal !== undefined) {
@@ -329,2 +329,4 @@ if (this.options.trimValues) {
             || tagName === this.options.cdataPropName
+            || tagName === this.options.textNodeName
+            || tagName === this.options.attributesGroupName
           )) {
@@ -528,4 +530,14 @@ throw new Error(`Invalid tag name: ${tagName}`);
   // Replace standard entities
-  for (let entityName in this.lastEntities) {
+  for (const entityName of Object.keys(this.lastEntities)) {
     const entity = this.lastEntities[entityName];
+    const matches = val.match(entity.regex);
+    if (matches) {
+      this.entityExpansionCount += matches.length;
+      if (entityConfig.maxTotalExpansions &&
+        this.entityExpansionCount > entityConfig.maxTotalExpansions) {
+        throw new Error(
+          `Entity expansion limit exceeded: ${this.entityExpansionCount} > ${entityConfig.maxTotalExpansions}`
+        );
+      }
+    }
     val = val.replace(entity.regex, entity.val);
@@ -537,4 +549,15 @@ }
   if (this.options.htmlEntities) {
-    for (let entityName in this.htmlEntities) {
+    for (const entityName of Object.keys(this.htmlEntities)) {
       const entity = this.htmlEntities[entityName];
+      const matches = val.match(entity.regex);
+      if (matches) {
+        //console.log(matches);
+        this.entityExpansionCount += matches.length;
+        if (entityConfig.maxTotalExpansions &&
+          this.entityExpansionCount > entityConfig.maxTotalExpansions) {
+          throw new Error(
+            `Entity expansion limit exceeded: ${this.entityExpansionCount} > ${entityConfig.maxTotalExpansions}`
+          );
+        }
+      }
       val = val.replace(entity.regex, entity.val);
@@ -732,2 +755,12 @@ }
 
+function sanitizeName(name, options) {
+  if (util.criticalProperties.includes(name)) {
+    throw new Error(`[SECURITY] Invalid name: "${name}" is a reserved JavaScript keyword that could cause prototype pollution`);
+  } else if (util.DANGEROUS_PROPERTY_NAMES.includes(name)) {
+    return options.onDangerousProperty(name);
+  }
+  return name;
+}
+
 module.exports = OrderedObjParser;
+

test_output_2.txt

-Error: While loading /home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js: SyntaxError: The requested module './TagPath.js' does not provide an export named 'TagPath'
-    at fixupImportException (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/loader.js:152:12)
-    at /home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/loader.js:31:37
-    at async Jasmine._loadFiles (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:142:7)
-    ... 5 lines matching cause stack trace ...
-    at async Command.run (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:72:9) {
-  [cause]: file:///home/amit/code/git/temp/fast-xml-parser/src/v6/TagPathMatcher.js:1
-  import {TagPath} from './TagPath.js';
-          ^^^^^^^
-  SyntaxError: The requested module './TagPath.js' does not provide an export named 'TagPath'
-      at ModuleJob._instantiate (node:internal/modules/esm/module_job:180:21)
-      at async ModuleJob.run (node:internal/modules/esm/module_job:263:5)
-      at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:578:26)
-      at async Jasmine._loadFiles (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:142:7)
-      at async Jasmine.loadSpecs (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:133:5)
-      at async /home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:223:9
-      at async Jasmine.withinGlobalSetup_ (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/runner_base.js:420:7)
-      at async Jasmine.execute (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:222:7)
-      at async runJasmine (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:209:5)
-      at async Command.run (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:72:9)
-}

test_output_3.txt

-TypeError: Cannot read properties of undefined (reading 'preserveOrder')
-    at buildOptions (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/OutputBuilders/ParserOptionsBuilder.js:53:12)
-    at new OutputBuilder (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/OutputBuilders/JsObjBuilder.js:7:22)
-    at file:///home/amit/code/git/temp/fast-xml-parser/src/v6/OptionsBuilder.js:35:18
-    at ModuleJob.run (node:internal/modules/esm/module_job:271:25)
-    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:578:26)
-    at async Jasmine._loadFiles (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:142:7)
-    at async Jasmine.loadSpecs (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:133:5)
-    at async /home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:223:9
-    at async Jasmine.withinGlobalSetup_ (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/runner_base.js:420:7)
-    at async Jasmine.execute (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:222:7)

test_output_4.txt

-Randomized with seed 20147
-Started
-..F.F
-
-Failures:
-1) XMLParser v6 should parse only true numbers
-  Message:
-    Expected $.rootNode.intTag = 45 to equal '045'.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:63:20)
-        at <Jasmine>
-
-2) XMLParser v6 should not parse values to primitive type
-  Message:
-    Expected $.rootNode.boolean = true to equal 'true'.
-    Expected $.rootNode.intTag = 45 to equal '045'.
-    Expected $.rootNode.floatTag = 65.34 to equal '65.34'.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:120:20)
-        at <Jasmine>
-
-5 specs, 2 failures
-Finished in 0.016 seconds
-Randomized with seed 20147 (jasmine --random=true --seed=20147)

test_output_5.txt

-Randomized with seed 74872
-Started
-..F..
-
-Failures:
-1) XMLParser v6 should parse all values as string, int, boolean, float, hexadecimal
-  Message:
-    Expected $.rootNode.boolean = 'true' to equal true.
-    Expected $.rootNode.intTag = '045' to equal 45.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:28:20)
-        at <Jasmine>
-
-5 specs, 1 failure
-Finished in 0.014 seconds
-Randomized with seed 74872 (jasmine --random=true --seed=74872)

test_output_6.txt

-Randomized with seed 51104
-Started
-TagName: tag ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-TagName: boolean ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-TagName: intTag ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-TagName: floatTag ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-TagName: hexadecimal ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-TagName: rootNode ValueParsers: [
-  'trim',     'join',
-  'number',   'boolean',
-  'currency', 'trim',
-  'number',   'boolean',
-  'currency'
-]
-.TagName: tag ValueParsers: []
-TagName: boolean ValueParsers: []
-TagName: intTag ValueParsers: []
-TagName: floatTag ValueParsers: []
-TagName: rootNode ValueParsers: []
-.TagName: tag ValueParsers: []
-TagName: rootNode ValueParsers: []
-.TagName: floatTag0 ValueParsers: [ numParser { options: { leadingZeros: false } } ]
-TagName: floatTag1 ValueParsers: [ numParser { options: { leadingZeros: false } } ]
-TagName: floatTag2 ValueParsers: [ numParser { options: { leadingZeros: false } } ]
-TagName: floatTag3 ValueParsers: [ numParser { options: { leadingZeros: false } } ]
-TagName: rootNode ValueParsers: [ numParser { options: { leadingZeros: false } } ]
-.TagName: tag ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-TagName: boolean ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-TagName: intTag ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-TagName: floatTag ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-TagName: long ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-TagName: rootNode ValueParsers: [
-  'boolean',
-  numParser {
-    options: { hex: true, leadingZeros: false, eNotation: true }
-  }
-]
-.
-
-
-5 specs, 0 failures
-Finished in 0.015 seconds
-Randomized with seed 51104 (jasmine --random=true --seed=51104)

test_output_7.txt

-Randomized with seed 51667
-Started
-......FFF.F
-
-Failures:
-1) XMLParser v6 should skip tag arguments
-  Message:
-    Expected $.rootNode.intTag = '45' to equal 45.
-    Expected $.rootNode.floatTag = '65.34' to equal 65.34.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:165:20)
-        at <Jasmine>
-
-2) XMLParser v6 should ignore namespace and text node attributes
-  Message:
-    Expected object to have properties
-        node: Object({ tag: Object({ @_arg: 'value', #text: 'value' }), intTag: Object({ @_arg: 'value', @_arg2: 'value2', #text: 45 }), floatTag: 65.34, nsTag: Object({ @_attr: 'tns' }), nsTagNoAttr: '' })
-    Expected object not to have properties
-        root:node: Object({ tag: Object({ @_ns:arg: 'value', #text: 'value' }), intTag: Object({ @_ns:arg: 'value', @_ns:arg2: 'value2', #text: '45' }), floatTag: '65.34', nsTag: Object({ @_xmlns:tns-ns: 'urn:none', @_tns-ns:attr: 'tns' }), nsTagNoAttr: Object({ @_xmlns:tns-ns: 'urn:none' }) })
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:207:20)
-        at <Jasmine>
-
-3) XMLParser v6 should parse all values as string, int, boolean, float, hexadecimal
-  Message:
-    Expected $.rootNode.boolean = 'true' to equal true.
-    Expected $.rootNode.intTag = '045' to equal 45.
-    Expected $.rootNode.floatTag = '65.34' to equal 65.34.
-    Expected $.rootNode.hexadecimal = '0x15' to equal 21.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:28:20)
-        at <Jasmine>
-
-4) XMLParser v6 should parse repeated nodes in array
-  Message:
-    Expected $.rootNode.tag[1] = '45' to equal 45.
-    Expected $.rootNode.tag[2] = '65.34' to equal 65.34.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:259:20)
-        at <Jasmine>
-
-11 specs, 4 failures
-Finished in 0.023 seconds
-Randomized with seed 51667 (jasmine --random=true --seed=51667)

test_output_8.txt

-Randomized with seed 18744
-Started
-.....FF....
-
-Failures:
-1) XMLParser v6 should parse nested nodes in nested properties
-  Message:
-    Expected $.rootNode.parenttag.tag[1] = '45' to equal 45.
-    Expected $.rootNode.parenttag.tag[2] = '65.34' to equal 65.34.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:281:20)
-        at <Jasmine>
-
-2) XMLParser v6 should ignore namespace and text node attributes
-  Message:
-    ReferenceError: reportError is not defined
-  Stack:
-        at resolveNameSpace (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:232:12)
-        at Xml2JsParser.processTagName (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:185:12)
-        at Xml2JsParser.readClosingTag (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:87:26)
-        at Xml2JsParser.parseXml (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:69:16)
-        at Xml2JsParser.parse (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:35:10)
-        at XMLParser.parse (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/XMLParser.js:34:23)
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:205:25)
-        at <Jasmine>
-
-11 specs, 2 failures
-Finished in 0.02 seconds
-Randomized with seed 18744 (jasmine --random=true --seed=18744)

test_output_9.txt

-Randomized with seed 42237
-Started
-.F.....FF..
-
-Failures:
-1) XMLParser v6 should ignore namespace and text node attributes
-  Message:
-    Error: Multiple namespaces tag
-  Stack:
-        at resolveNameSpace (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:232:18)
-        at Xml2JsParser.processTagName (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:185:12)
-        at Xml2JsParser.readClosingTag (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:87:26)
-        at Xml2JsParser.parseXml (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:69:16)
-        at Xml2JsParser.parse (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/Xml2JsParser.js:35:10)
-        at XMLParser.parse (file:///home/amit/code/git/temp/fast-xml-parser/src/v6/XMLParser.js:34:23)
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:205:25)
-        at <Jasmine>
-
-2) XMLParser v6 should parse all values as string, int, boolean, float, hexadecimal
-  Message:
-    Expected $.rootNode.boolean = 'true' to equal true.
-    Expected $.rootNode.intTag = '045' to equal 45.
-    Expected $.rootNode.floatTag = '65.34' to equal 65.34.
-    Expected $.rootNode.hexadecimal = '0x15' to equal 21.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:28:20)
-        at <Jasmine>
-
-3) XMLParser v6 should parse nested nodes in nested properties
-  Message:
-    Expected $.rootNode.parenttag.tag[1] = '45' to equal 45.
-    Expected $.rootNode.parenttag.tag[2] = '65.34' to equal 65.34.
-  Stack:
-        at <Jasmine>
-        at UserContext.<anonymous> (file:///home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js:281:20)
-        at <Jasmine>
-
-11 specs, 3 failures
-Finished in 0.02 seconds
-Randomized with seed 42237 (jasmine --random=true --seed=42237)

test_output.txt

-Error: While loading /home/amit/code/git/temp/fast-xml-parser/spec/v6/xmlParser_spec.js: SyntaxError: The requested module './OutputBuilders/JsObjBuilder.js' does not provide an export named 'JsObjOutputBuilder'
-    at fixupImportException (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/loader.js:152:12)
-    at /home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/loader.js:31:37
-    at async Jasmine._loadFiles (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:142:7)
-    ... 5 lines matching cause stack trace ...
-    at async Command.run (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:72:9) {
-  [cause]: file:///home/amit/code/git/temp/fast-xml-parser/src/v6/OptionsBuilder.js:2
-  import {JsObjOutputBuilder} from './OutputBuilders/JsObjBuilder.js';
-          ^^^^^^^^^^^^^^^^^^
-  SyntaxError: The requested module './OutputBuilders/JsObjBuilder.js' does not provide an export named 'JsObjOutputBuilder'
-      at ModuleJob._instantiate (node:internal/modules/esm/module_job:180:21)
-      at async ModuleJob.run (node:internal/modules/esm/module_job:263:5)
-      at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:578:26)
-      at async Jasmine._loadFiles (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:142:7)
-      at async Jasmine.loadSpecs (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:133:5)
-      at async /home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:223:9
-      at async Jasmine.withinGlobalSetup_ (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/runner_base.js:420:7)
-      at async Jasmine.execute (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/jasmine.js:222:7)
-      at async runJasmine (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:209:5)
-      at async Command.run (/home/amit/code/git/temp/fast-xml-parser/node_modules/jasmine/lib/command.js:72:9)
-}

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Lines of code

4524

2.84%

Worsened metrics

Total package byte prevSize

196841

-4.71%

Number of package files

45

-16.67%

No dependency changes