Socket
Socket
Sign inDemoInstall

saxes

Package Overview
Dependencies
1
Maintainers
1
Versions
30
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install
Previous12

3.1.4

Diff

Changelog

Source

3.1.4 (2018-12-03)

Bug Fixes

  • add fragment and additionalNamespaces to SaxesOption typing (02d8275)

<a name="3.1.3"></a>

lddubeau
published 3.1.3 •

Changelog

Source

3.1.3 (2018-10-01)

Bug Fixes

Performance Improvements

  • don't check twice if this.textNode is set (00536cc)
  • reduce the frequency at which we clear attribValue (1570615)

<a name="3.1.2"></a>

lddubeau
published 3.1.2 •

Changelog

Source

3.1.2 (2018-08-31)

Bug Fixes

  • CDATA end in attributes must not cause an error (a7495ac)
  • normalize \r\n and \r followed by something else to \n (d7b1abe), closes #2

<a name="3.1.1"></a>

lddubeau
published 3.1.1 •

Changelog

Source

3.1.1 (2018-08-29)

Bug Fixes

  • resolve is now part of the public API (bb4bed5)

<a name="3.1.0"></a>

lddubeau
published 3.1.0 •

Changelog

Source

3.1.0 (2018-08-28)

Bug Fixes

Performance Improvements

  • add emitNodes to skip checking text buffer more than needed (9d5e357)
  • capture names in the name field (c7dffd5)
  • introduce a specialized version of captureWhile (04855d6)
  • introduce captureTo and captureToChar (76eb95a)
  • remove skipWhitespace (c8b7ae2)
  • remove some redundant buffer resets (5ded326)
  • use charCodeAt and handle surrogates ourselves (b8ec232)

<a name="3.0.0"></a>

lddubeau
published 3.0.0 •

Changelog

Source

3.0.0 (2018-08-21)

Features

  • process the xmlns attribute the customary way (2c9672a)

BREAKING CHANGES

  • In previous versions the attribute xmlns (as in <foo xmlns="some-uri"> would be reported as having the prefix "xmlns" and the local name "". This behavior was inherited from sax. There was some logic to it, but this behavior was surprising to users of the library. The principle of least surprise favors eliminating that surprising behavior in favor of something less surprising.

This commit makes it so that xmlns is not reported as having a prefix of "" and a local name of "xmlns". This accords with how people interpret attribute names like foo, bar, moo which all have no prefix and a local name.

Code that deals with namespace bindings or cares about xmlns probably needs to be changed.

<a name="2.2.1"></a>

lddubeau
published 2.2.1 •

Changelog

Source

2.2.1 (2018-08-20)

Bug Fixes

  • use isNameChar for later chars in PI target (83d2b61)

<a name="2.2.0"></a>

lddubeau
published 2.2.0 •

Changelog

Source

2.2.0 (2018-08-20)

Features

  • add the resolvePrefix option (90301fb)

<a name="2.1.0"></a>

lddubeau
published 2.1.0 •

Changelog

Source

2.1.0 (2018-08-20)

Features

  • add support for parsing fragments (1ff2d6a)
  • stronger check on bad cdata closure (d416760)

Performance Improvements

  • concatenate openWakaBang just once (07345bf)
  • improve text node checking speed (f270e8b)
  • minor optimizations (c7e36bf)
  • remove an unnecessary variable (ac03a1c)
  • remove handler check (fbe35ff)
  • simplify captureWhile (bb2085c)
  • simplify the skip functions (c7b8c3b)
  • the c field has been unused for a while: remove it (9ca0246)
  • use strings for the general states (3869908)

<a name="2.0.0"></a>

lddubeau
published 2.0.0 •

Changelog

Source

2.0.0 (2018-07-23)

Bug Fixes

  • "X" is not a valid hex prefix for char references (465038b)
  • add namespace checks (9f94c4b)
  • always run in strict mode (ed8b0b1)
  • check that the characters we read are valid char data (7611a85)
  • disallow spaces after open waka (da7f76d)
  • drop the lowercase option (987d4bf)
  • emit CDATA on empty CDATA section too (95d192f)
  • emit empty comment (b3db392)
  • entities are always strict (0f6a30e)
  • fail on colon at start of QName (507addd)
  • harmonize error messages and initialize flags (9a20cad)
  • just one error for text before the root, and text after (101ea50)
  • more namespace checks (a1add21)
  • move namespace checks to their proper place (4a1c99f)
  • only accept uppercase CDATA to mark the start of CDATA (e86534d)
  • prevent colons in pi and entity names when xmlns is true (4327eec)
  • prevent empty entities (04e1593)
  • raise an error if the document does not have a root (f2de520)
  • raise an error on ]]> in character data (2964381)
  • raise an error on < in attribute values (4fd67a1)
  • raise an error on multiple root elements (45047ae)
  • raise error on CDATA before or after root (604241f)
  • raise error on character reference outside CHAR production (30fb540)
  • remove broken or pointless examples (1a5b642)
  • report an error on duplicate attributes (ee4e340)
  • report an error on whitespace at the start of end tag (c13b122)
  • report processing instructions that do not have a target (c007e39)
  • treat ?? in processing instructions correctly (bc1e1d4)
  • trim URIs (78cc6f3)
  • use xmlchars for checking names (2c939fe)
  • verify that character references match the CHAR production (369afde)

Code Refactoring

  • adjust the names used for processing instructions (3b508e9)
  • convert code to ES6 (fe81170)
  • drop attribute event (c7c2e80)
  • drop buffer size checks (9ce2f7a)
  • drop normalize (9c6d84c)
  • drop opencdata and on closecdata (3287d2c)
  • drop SGML declaration parsing (4aaf2d9)
  • drop the parser function, rename SAXParser (0878a6c)
  • drop trim (c03c7d0)
  • pass the actual tag to onclosetag (7020e64)
  • provide default no-op implementation for events (a94687f)
  • remove the API based on Stream (ebb659a)
  • simplify namespace processing (2d4ce0f)

Features

  • drop the resume() method; and have onerror() throw (ac601e5)
  • handle XML declarations (5258939)
  • revamped error messages (cf9c589)
  • the flush method returns its parser (68c2020)

BREAKING CHANGES

  • Sax was only passing the tag name. We pass the whole object.
  • The API no longer takes a strict argument anywhere. This also effectively removes support for HTML processing, or allow processing without errors anything which is less than full XML. It also removes special processing of script elements.
  • attribute is not a particularly useful event for parsing XML. The only thing it adds over looking at attributes on tag objects is that you get the order of the attributes from the source, but attribute order in XML is irrelevant.
  • The opencdata and closecdata events became redundant once we removed the buffer size limitations. So we remove these events.
  • The parser function is removed. Just create a new instance with new.

SAXParser is now SaxesParser. So new require("saxes").SaxesParser(...).

  • The API based on Stream is gone. There were multiple issues with it. It was Node-specific. It used an ancient Node API (the so-called "classic streams"). Its behavior was idiosyncratic.

  • Sax had no default error handler but if you wanted to continue calling write() after an error you had to call resume(). We do away with resume() and instead install a default onerror which throws. Replace with a no-op handler if you want to continue after errors.

  • The "processinginstruction" now produces a "target" field instead of a "name" field. The nomenclature "target" is the one used in the XML literature.

    • The ns field is no longer using the prototype trick that sax used. The ns field of a tag contains only those namespaces that the tag declares.
  • We no longer have opennamespace and closenamespace events. The information they provide can be obtained by examining the tags passed to tag events.

  • SGML declaration is not supported by XML. This is an XML parser. So we remove support for SGML declarations. They now cause errors.

  • We removed support for the code that checked buffer sizes and would raise errors if a buffer was close to an arbitrary limit or emitted multiple text or cdata events in order avoid passing strings greater than an arbitrary size. So MAX_BUFFER_LENGTH is gone.

The feature always seemed a bit awkward. Client code could limit the size of buffers to 1024K, for instance, and not get a text event with a text payload greater than 1024K... so far so good but if the same document contained a comment with more than 1024K that would result in an error. Hmm.... why? The distinction seems entirely arbitrary.

The upshot is that client code needs to be ready to handle strings of any length supported by the platform.

If there's a clear need to reintroduce it, we'll reassess.

  • It is no longer possible to load the library as-is through a script element. It needs building.

The library now assumes a modern runtime. It no longer contains any code to polyfill what's missing. It is up to developers using this code to deal with polyfills as needed.

  • We drop the trim option. It is up to client code to trip text if it needs it.
  • We no longer support the normalize option. It is up to client code to perform whatever normalization it wants.
  • The lowercase option makes no sense for XML. It is removed.
  • Remove support for strictEntities. Entities are now always strict, as required by the XML specification.
  • By default parsers now have a default no-op implementation for each event it supports. This would break code that determines whether a custom handler was added by checking whether there's any handler at all. This removes the necessity for the parser implementation to check whether there is a handler before calling it.

In the process of making this change, we've removed support for the on... properties on streams objects. Their existence was not warranted by any standard API provided by Node. (EventEmitter does not have on... properties for events it supports, nor does Stream.) Their existence was also undocumented. And their functioning was awkward. For instance, with sax, this:

const s = sax.createStream();
const handler = () => console.log("moo");
s.on("cdata", handler);
console.log(s.oncdata === handler);

would print false. If you examine s.oncdata you see it is glue code instead of the handler assigned. This is just bizarre, so we removed it.

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc