xml2json - npm Package Compare versions

Comparing version 0.11.0 to 0.11.2

lib/json2xml.js

@@ -79,3 +79,3 @@ var sanitizer = require('./sanitize.js')
     if (this.options.sanitize) {
-        val = sanitizer.sanitize(val)
+        val = sanitizer.sanitize(val, false, true);
     }
@@ -86,3 +86,4 @@ this.xml += ' ' + key + '="' + val + '"';
     this.completeTag();
-    this.xml += text;
+    var newText = (this.options.sanitize ? sanitizer.sanitize(text) : text);
+    this.xml += newText;
 }
@@ -89,0 +90,0 @@ ToXml.prototype.closeTag = function(key) {

lib/sanitize.js

@@ -15,9 +15,26 @@ /**
  */
-var chars = {
+// used for body text
+var charsEscape = {
     '&': '&',
-    '#': '#',
     '<': '&lt;',
+    '>': '&gt;'
+};
+
+var charsUnescape = {
+    '&amp;': '&',
+    '&#35;': '#',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&#40;': '(',
+    '&#41;': ')',
+    '&quot;': '"',
+    '&apos;': "'",
+    "&#31;": "\u001F"
+};
+
+// used in attribute values
+var charsAttrEscape = {
+    '&': '&amp;',
+    '<': '&lt;',
     '>': '&gt;',
-    '(': '&#40;',
-    ')': '&#41;',
     '"': '&quot;',
@@ -31,3 +48,4 @@ "'": '&apos;'
 
-exports.sanitize = function sanitize(value, reverse) {
+// sanitize body text
+exports.sanitize = function sanitize(value, reverse, attribute) {
     if (typeof value !== 'string') {
@@ -37,11 +55,10 @@ return value;
 
-    Object.keys(chars).forEach(function(key) {
-        if (reverse) {
-            value = value.replace(new RegExp(escapeRegExp(chars[key]), 'g'), key);
-        } else {
-            value = value.replace(new RegExp(escapeRegExp(key), 'g'), chars[key]);
-        }
+    var chars = reverse ? charsUnescape : (attribute ? charsAttrEscape : charsEscape);
+    var keys = Object.keys(chars);
+    
+    keys.forEach(function(key) {
+        value = value.replace(new RegExp(escapeRegExp(key), 'g'), chars[key]);
     });
 
     return value;
-}
+};

lib/xml2json.js

@@ -63,5 +63,6 @@ var expat = require('node-expat');
 
-        if (options.sanitize) {
-            currentObject[textNodeName()] = sanitizer.sanitize(currentObject[textNodeName()], true);
-        }
+        // node-expat already reverse sanitizes it whether we like it or not
+        //if (options.sanitize) {
+        //    currentObject[textNodeName()] = sanitizer.sanitize(currentObject[textNodeName()], true);
+        //}
 
@@ -68,0 +69,0 @@ currentObject[textNodeName()] = coerce(currentObject[textNodeName()],name);

package.json

 {
   "name": "xml2json",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Converts xml to json and vice-versa, using node-expat.",
@@ -12,4 +12,4 @@ "repository": "git://github.com/buglabs/node-xml2json.git",
   "dependencies": {
-    "hoek": "^4.0.1",
-    "joi": "^9.0.4",
+    "hoek": "^4.2.1",
+    "joi": "^13.1.2",
     "node-expat": "^2.3.15"
@@ -16,0 +16,0 @@ },

test/fixtures/xmlsanitize.json

@@ -1,1 +0,1 @@
-{"e":{"a":{"b":"Smith & Son"}}}
+{"e":{"a":{"b":"<\"Smith\" & 'Son'>","$t":"Movers & <b>Shakers</b> Extraordinaire #()\"'"}}}

test/fixtures/xmlsanitize2.json

@@ -1,1 +0,1 @@
-{"e":"Smith & Son"}
+{"e":{"$t":"<b>Smith</b> & <b>Son</b>"}}

test/test.js

@@ -102,3 +102,3 @@ var fs = require('fs');
         var xml = internals.readFixture('xmlsanitize2.xml');
-        var result = parser.toJson(xml, {sanitize: true});
+        var result = parser.toJson(xml, {sanitize: true, reversible: true});
         var json = internals.readFixture('xmlsanitize2.json');
@@ -111,2 +111,45 @@
 
+    it('does json unsanitize', function (done) {
+
+        var json = internals.readFixture('xmlsanitize.json');
+        var result = parser.toXml(json, {sanitize: true});
+        var xml = internals.readFixture('xmlsanitize.xml');
+
+        expect(result).to.equal(xml);
+
+        done();
+    });
+
+    it('does json unsanitize of text', function (done) {
+
+        var json = internals.readFixture('xmlsanitize2.json');
+        var result = parser.toXml(json, {sanitize: true});
+        var xml = internals.readFixture('xmlsanitize2.xml');
+
+        expect(result).to.equal(xml);
+
+        done();
+    });
+
+    it('does doesnt double sanitize', function (done) {
+
+        var json = internals.readFixture('xmlsanitize3.json');
+        var result = parser.toXml(json, {sanitize: true});
+        var xml = internals.readFixture('xmlsanitize3.xml');
+
+        expect(result).to.equal(xml);
+
+        done();
+    });
+
+    it('does doesnt double unsanitize', function (done) {
+
+        var xml = internals.readFixture('xmlsanitize3.xml');
+        var result = parser.toJson(xml, {sanitize: true, reversible: true});
+        var json = internals.readFixture('xmlsanitize3.json');
+
+        expect(result).to.equal(json);
+        done();
+    });
+
     it('converts with forceArrays', function(done) {
@@ -252,4 +295,4 @@ var xml = internals.readFixture('forceArray.xml');
 
-        var xml = fs.readFileSync('./test/fixtures/array-notation.xml');
-        var expectedJson = JSON.parse( fs.readFileSync('./test/fixtures/array-notation.json') );
+        var xml = internals.readFixture('array-notation.xml');
+        var expectedJson = JSON.parse( internals.readFixture('array-notation.json') );
 
@@ -256,0 +299,0 @@ var json = parser.toJson(xml, {object: true, arrayNotation: true});

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

88855

increased by2.28%

Lines of code

687

increased by6.84%

Dependency changes

• + Addedhoek@5.0.46.1.3(transitive)

• + Addedisemail@3.2.0(transitive)

• + Addedjoi@13.7.0(transitive)

• + Addedpunycode@2.3.1(transitive)

• + Addedtopo@3.0.3(transitive)

• - Removedisemail@2.2.1(transitive)

• - Removeditems@2.2.1(transitive)

• - Removedjoi@9.2.0(transitive)

• - Removedmoment@2.30.1(transitive)

• - Removedtopo@2.1.1(transitive)

• Updatedhoek@^4.2.1

• Updatedjoi@^13.1.2