sax - npm Package Compare versions

Comparing version 0.1.2 to 0.1.3

lib/sax.js

@@ -41,3 +41,3 @@
 function checkBufferLength (parser) {
-  var maxAllowed = sax.MAX_BUFFER_LENGTH,
+  var maxAllowed = Math.max(sax.MAX_BUFFER_LENGTH, 10),
     maxActual = 0;
@@ -57,3 +57,4 @@ for (var i = 0, l = buffers.length; i < l; i ++) {
           break
-        default: error(parser, "Max buffer length exceeded: "+buffers[i])
+        default:
+          error(parser, "Max buffer length exceeded: "+buffers[i])
       }
@@ -277,2 +278,14 @@ }
       case S.TEXT:
+        if (parser.sawRoot && !parser.closedRoot) {
+          var starti = i-1;
+          while (c && c!=="<" && c!=="&") {
+            c = chunk.charAt(i++);
+            parser.position ++;
+            if (c === "\n") {
+              parser.line ++;
+              parser.column = 0;
+            } else parser.column ++;
+          }
+          parser.textNode += chunk.substring(starti, i-1);
+        }
         if (c === "<") parser.state = S.OPEN_WAKA;
@@ -412,2 +425,4 @@ else {
           parser.state = S.TEXT;
+        } else if (c === "]") {
+          parser.cdata += "]"
         } else {
@@ -599,8 +614,8 @@ parser.cdata += "]]" + c;
   // cdata blocks can get very big under normal conditions. emit and move on.
-  if (parser.state === S.CDATA && parser.cdata) {
-    emitNode(parser, "oncdata", parser.cdata);
-    parser.cdata = "";
-  }
+  // if (parser.state === S.CDATA && parser.cdata) {
+  //   emitNode(parser, "oncdata", parser.cdata);
+  //   parser.cdata = "";
+  // }
   if (parser.position >= parser.bufferCheckPosition) checkBufferLength(parser);
   return parser;
 }

package.json

 { "name" : "sax"
 , "author" : "Isaac Z. Schlueter <[e-mail]>"
-, "version" : "0.1.2"
+, "version" : "0.1.3"
 , "main" : "lib/sax"
@@ -5,0 +5,0 @@ , "license" : "MIT"

test/buffer-overrun.js

 // set this really low so that I don't have to put 64 MB of xml in here.
-require(require("path").join(__dirname, "../lib/sax")).MAX_BUFFER_LENGTH = 5;
+var sax = require("../lib/sax")
+var bl = sax.MAX_BUFFER_LENGTH
+sax.MAX_BUFFER_LENGTH = 5;
 
@@ -22,2 +24,3 @@ require(__dirname).test({
   .write("</abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ>")
-  .close();
+  .close();
+sax.MAX_BUFFER_LENGTH = bl

test/cdata-chunked.js

@@ -6,4 +6,3 @@
     ["opencdata", undefined],
-    ["cdata", " this is "],
-    ["cdata", "character data  "],
+    ["cdata", " this is character data  "],
     ["closecdata", undefined],
@@ -10,0 +9,0 @@ ["closetag", "R"]

test/index.js

@@ -54,15 +54,21 @@
   fs.readdir(__dirname, function (error, files) {
+    files = files.filter(function (file) {
+      return (/\.js$/.exec(file) && file !== 'index.js')
+    })
+    var n = files.length
+      , i = 0
+    console.log("0.." + n)
     files.forEach(function (file) {
       // run this test.
-      if (/\.js$/.exec(file)) {
-        try {
-          require(path.resolve(__dirname, file))
-        } catch (er) {
-          fail(file, er)
-        }
+      try {
+        require(path.resolve(__dirname, file))
+        console.log("ok " + (++i) + " - " + file)
+      } catch (er) {
+        console.log("not ok "+ (++i) + " - " + file)
+        fail(file, er)
       }
     })
-    if (!failures) return sys.puts("ok");
-    else return sys.error(failures + " failure" + (failures > 1 ? "s" : ""));
+    if (!failures) return console.log("#all pass");
+    else return console.error(failures + " failure" + (failures > 1 ? "s" : ""));
   });
 }

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

165158

increased by32.63%

Number of package files

33

increased by57.14%

Lines of code

1985

increased by104.64%

Worsened metrics

Number of low supply chain risk alerts

24

increased by60%

Number of medium supply chain risk alerts

2

increased byInfinity%

No dependency changes