xml-js - npm Package Compare versions

Comparing version 1.3.4 to 1.4.0

bin/cli.js

@@ -24,3 +24,3 @@ #!/usr/bin/env node
     {arg: 'trim', type: 'flag', option:'trim', desc: 'Any whitespaces surrounding texts will be trimmed.'},
-    {arg: 'sanitize', type: 'flag', option:'sanitize', desc: 'Special xml characters will be replaced with entity codes.'},
+    // {arg: 'sanitize', type: 'flag', option:'sanitize', desc: 'Special xml characters will be replaced with entity codes.'},
     {arg: 'native-type', type: 'flag', option:'nativeType', desc: 'Numbers and boolean will be converted (coerced) to native type instead of text.'},
@@ -27,0 +27,0 @@ {arg: 'always-array', type: 'flag', option:'alwaysArray', desc: 'Every element will always be an array type (applicable if --compact is set).'},

lib/common.js

 /*jslint node:true */
 
 module.exports = {
-    sanitize: function (text) {
-        return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+    sanitizeElement: function (text) {
+        return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
     },
+    // sanitizeAttribute: function (text) {
+    //     // should escape " if attribute is enclosed in " otherwise escape ' if attribute is enclosed in '
+    //     return text.replace(/"/g, "&quot;").replace(/'/g, "&apos;"); // or use &#39; for '
+    // },
     copyOptions: function (options) {
@@ -73,2 +77,2 @@ var key, copy = {};
     }
-};
+};

lib/js2xml.js

@@ -45,3 +45,3 @@ var common = require('./common');
         if (attributes.hasOwnProperty(key)) {
-            result += ' ' + key + '="' + writeText(attributes[key], {ignoreText: false}) + '"';
+            result += ' ' + key + '="' + attributes[key].replace(/"/g, """) + '"';
         }
@@ -87,3 +87,4 @@ }
     text = '' + text; // ensure Number and Boolean are converted to String
-    return options.ignoreText ? '' : text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+    text = text.replace(/&amp;/g, '&'); // desanitize to avoid double sanitization
+    return options.ignoreText ? '' : text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
@@ -90,0 +91,0 @@

lib/xml2js.js

@@ -124,5 +124,2 @@ var sax = require('sax');
         }
-        if (options.sanitize) {
-            instruction.body = common.sanitize(instruction.body);
-        }
         var value = {};
@@ -208,3 +205,3 @@ if (options.instructionHasAttributes && Object.keys(attributes).length) {
     if (options.sanitize) {
-        text = common.sanitize(text);
+        text = text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
     }
@@ -221,5 +218,2 @@ addField('text', text, options);
     }
-    if (options.sanitize) {
-        comment = common.sanitize(comment);
-    }
     addField('comment', comment, options);
@@ -226,0 +220,0 @@ }

package.json

 {
   "name": "xml-js",
-  "version": "1.3.4",
+  "version": "1.4.0",
   "description": "A convertor between XML text and Javascript object / JSON text.",
@@ -5,0 +5,0 @@ "repository": {

README.md

@@ -191,3 +191,3 @@ ![XML ⇔ JS/JSON](http://nashwaan.github.io/xml-js/images/logo.svg)
 | `trim`              | `false` | Whether to trim whitespace characters that may exist before and after the text. |
-| `sanitize`          | `false` | Whether to replace `&` `<` `>` `"` `'` with `&amp;` `&lt;` `&gt;` `&quot;` `&#39;` respectively in the resultant text. |
+| `sanitize` ([Deprecated](https://github.com/nashwaan/xml-js/issues/26)) | `false` | Whether to replace `&` `<` `>` with `&amp;` `&lt;` `&gt;` respectively, in the resultant text. |
 | `nativeType`        | `false` | Whether to attempt converting text of numerals or of boolean values to native type. For example, `"123"` will be `123` and `"true"` will be `true` |
@@ -295,3 +295,2 @@ | `addParent`         | `false` | Whether to add `parent` property in each element object that points to parent object. |
   --compact            JSON is in compact form.
-  --sanitize           Special xml characters will be replaced with entity codes.
   --native-type        Numbers and boolean will be converted (coerced) to native type instead of text.
@@ -298,0 +297,0 @@ --always-array       Every element will always be an array type (applicable if --compact is set).

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Worsened metrics

Total package byte prevSize

66757

decreased by-0.02%

Number of lines in readme file

329

decreased by-0.3%

No dependency changes