Skip to content

Commit ecb2ca1

Browse files
committed
update release info
1 parent 910dae5 commit ecb2ca1

File tree

11 files changed

+1195
-673
lines changed

11 files changed

+1195
-673
lines changed

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
<small>Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.</small>
22

3+
**5.3.6 / 2026-02-14**
4+
- Improve security and performance of entity processing
5+
- new options `maxEntitySize`, `maxExpansionDepth`, `maxTotalExpansions`, `maxExpandedLength`, `allowedTags`,`tagFilter`
6+
- fast return when no edtity is present
7+
- improvement replacement logic to reduce number of calls
8+
39

410
**5.3.5 / 2026-02-08**
511
- fix: Escape regex char in entity name

docs/v4/2.XMLparseOptions.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -691,7 +691,12 @@ const XMLdata = `
691691
```
692692

693693
## processEntities
694-
Set it to `true` (default) to process default and DOCTYPE entities. Check [Entities](./5.Entities.md) section for more detail. If you don't have entities in your XML document then it is recommended to disable it `processEntities: false` for better performance.
694+
- false (Recommended): The parser will recognize the `<!DOCTYPE>` and `<!ENTITY>` tags but will not perform any string substitution. This prevents Entity Expansion (DoS) attacks while allowing the rest of the XML to be parsed normally, even if the DOCTYPE internal subset is complex.
695+
696+
- true: The parser will actively replace all `&entity;` references with their defined values. Use with caution: only enable this for trusted XML sources to avoid resource exhaustion.
697+
698+
heck [Entities](./5.Entities.md) section for more detail.
699+
695700
## removeNSPrefix
696701

697702
Remove namespace string from tag and attribute names.

docs/v4/5.Entities.md

Lines changed: 141 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
2-
Entities are the variables that can be used in XML content to maintain consistency. Eg,
1+
Entities are the variables that can be used in XML content to maintain consistency. Eg,
32

43
```xml
54
<?xml version="1.0" encoding="UTF-8"?>
@@ -19,38 +18,116 @@ Entities are the variables that can be used in XML content to maintain consiste
1918
</note>
2019
```
2120

22-
You can define your own entities using DOCTYPE. FXP by default supports following XML entities;
21+
You can define your own entities using DOCTYPE. FXP by default supports following XML entities:
2322

2423
| Entity name | Character | Decimal reference | Hexadecimal reference |
2524
| :---------- | :-------- | :---------------- | :-------------------- |
26-
| quot | " | `&#34;` | `&#x22;` |
27-
| amp | & | `&#38;` | `&#x26;` |
28-
| apos | ' | `&#39;` | `&#x27;` |
29-
| lt | < | `&#60;` | `&#x3C;` |
30-
| gt | > | `&#62;` | `&#x3E;` |
25+
| quot | " | `&#34;` | `&#x22;` |
26+
| amp | & | `&#38;` | `&#x26;` |
27+
| apos | ' | `&#39;` | `&#x27;` |
28+
| lt | < | `&#60;` | `&#x3C;` |
29+
| gt | > | `&#62;` | `&#x3E;` |
30+
31+
## processEntities Configuration
32+
33+
**Type:** `Boolean | Object`
34+
**Default:** `true`
35+
36+
Controls how the parser handles XML entities with built-in security protections.
37+
38+
### Basic Usage
39+
40+
```js
41+
// Disable entity processing (recommended for untrusted XML)
42+
const parser = new XMLParser({
43+
processEntities: false
44+
});
45+
46+
// Enable with default security limits (safe for most use cases)
47+
const parser = new XMLParser({
48+
processEntities: true
49+
});
50+
```
51+
52+
### Security Limits (Advanced)
53+
54+
When `processEntities: true`, the parser applies these default limits to prevent denial-of-service attacks:
55+
56+
```js
57+
const parser = new XMLParser({
58+
processEntities: {
59+
enabled: true, // Master switch
60+
maxEntitySize: 10000, // Max 10KB per entity definition
61+
maxTotalExpansions: 1000, // Max 1000 entity replacements total
62+
maxExpandedLength: 100000 // Max 100KB total expanded content
63+
}
64+
});
65+
```
66+
67+
**Recommendations:**
68+
- **For untrusted XML:** Use `processEntities: false`
69+
- **For trusted XML with entities:** Use `processEntities: true` (default limits are safe)
70+
- **For custom security needs:** Configure limits based on your requirements
71+
72+
### How It Works
73+
74+
**When `false`:**
75+
- The parser recognizes `<!DOCTYPE>` and `<!ENTITY>` tags
76+
- Entity references like `&writer;` are **not** replaced - they remain as-is in the output
77+
- Prevents Entity Expansion attacks while allowing DOCTYPE parsing
78+
- **Best for:** Public APIs, untrusted XML sources, maximum security
79+
80+
**When `true`:**
81+
- The parser actively replaces all `&entity;` references with their defined values
82+
- Security limits prevent resource exhaustion attacks
83+
- **Best for:** Internal systems, trusted XML sources, when entities are needed
3184

32-
However, since the entity processing can impact the parser's performance drastically, you can use `processEntities: false` to disable it.
85+
### Security Protections
86+
87+
FXP includes multiple defense layers against entity expansion attacks:
88+
89+
1. **Entity Size Limit:** Prevents individual entities from being too large
90+
2. **Expansion Count Limit:** Prevents too many entity replacements
91+
3. **Total Size Limit:** Prevents output from growing too large
92+
4. **Parameter Entity Blocking:** Entities containing `&` are automatically ignored
93+
94+
These protections defend against:
95+
- Billion Laughs attack (exponential entity expansion)
96+
- Memory exhaustion attacks
97+
- CPU exhaustion attacks
98+
99+
**Example of blocked attack:**
100+
```xml
101+
<!DOCTYPE foo [
102+
<!ENTITY big "AAAAA..."> <!-- 50KB entity -->
103+
]>
104+
<root>&big;&big;&big;...</root> <!-- 1000+ repetitions -->
105+
```
106+
This would be blocked at the entity definition stage or during expansion, preventing resource exhaustion.
107+
108+
## XML Builder
109+
110+
XML Builder decodes default entities automatically. Eg:
33111

34-
XML Builder decodes default entities value. Eg
35112
```js
36113
const jsObj = {
37-
"note": {
38-
"@heading": "Reminder > \"Alert",
39-
"body": {
40-
"#text": " 3 < 4",
41-
"attr": "Writer: Donald Duck."
42-
},
43-
}
44-
};
45-
46-
const options = {
47-
attributeNamePrefix: "@",
48-
ignoreAttributes: false,
49-
// processEntities: false
50-
};
51-
const builder = new XMLBuilder(options);
52-
const output = builder.build(jsObj);
114+
"note": {
115+
"@heading": "Reminder > \"Alert",
116+
"body": {
117+
"#text": " 3 < 4",
118+
"attr": "Writer: Donald Duck."
119+
},
120+
}
121+
};
122+
123+
const options = {
124+
attributeNamePrefix: "@",
125+
ignoreAttributes: false,
126+
};
127+
const builder = new XMLBuilder(options);
128+
const output = builder.build(jsObj);
53129
```
130+
54131
Output:
55132
```xml
56133
<note heading="Reminder &gt; &quot;Alert">
@@ -61,9 +138,9 @@ Output:
61138
</note>
62139
```
63140

64-
## Side effects
141+
## Side Effects
65142

66-
Though FXP doesn't silently ignores entities with `&` in the values, following side effects are possible
143+
FXP silently ignores entities with `&` in their values for security. However, be aware of how multiple entities interact:
67144

68145
```xml
69146
<?xml version="1.0" encoding="UTF-8"?>
@@ -81,10 +158,10 @@ Though FXP doesn't silently ignores entities with `&` in the values, following s
81158
</note>
82159
```
83160

84-
Output
161+
Output:
85162

86163
```js
87-
{
164+
{
88165
"note": {
89166
"heading": "Reminder",
90167
"body": {
@@ -96,61 +173,57 @@ Output
96173
}
97174
```
98175

99-
To deal with such situation, use `&amp;` instead of `&` in XML document.
176+
To deal with literal ampersands, use `&amp;` in your XML document.
100177

101-
## Attacks
178+
## Security Note
102179

103-
Following attacks are possible due to entity processing
180+
While FXP blocks many entity-based attacks through its security limits and by rejecting entities with `&` in values, the following attack vectors are mitigated:
104181

105-
* Denial-of-Service Attacks
106-
* Classic XXE
107-
* Advanced XXE
108-
* Server-Side Request Forgery (SSRF)
109-
* XInclude
110-
* XSLT
182+
* **Denial-of-Service Attacks:** Blocked by size and expansion limits
183+
* **Classic XXE:** External entities are not supported
184+
* **Parameter Entities:** Automatically ignored
185+
* **Recursive Entities:** Blocked by refusing entities containing `&`
111186

112-
Since FXP doesn't allow entities with `&` in the values, above attacks should not work.
187+
**When `processEntities: false`:** All entity expansion is disabled, providing maximum security for untrusted XML.
113188

114189
## HTML Entities
115190

116-
Following HTML entities are supported by the parser by default when `htmlEntities: true`.
191+
Following HTML entities are supported when `htmlEntities: true`:
117192

118193
| Result | Description | Entity Name | Entity Number |
119194
| :----- | :--------------------------------- | :---------- | :------------ |
120-
| | non-breaking space | `&nbsp;` | `&#160;` |
121-
| < | less than | `&lt;` | `&#60;` |
122-
| > | greater than | `&gt;` | `&#62;` |
123-
| & | ampersand | `&amp;` | `&#38;` |
124-
| " | double quotation mark | `&quot;` | `&#34;` |
125-
| ' | single quotation mark (apostrophe) | `&apos;` | `&#39;` |
126-
| ¢ | cent | `&cent;` | `&#162;` |
127-
| £ | pound | `&pound;` | `&#163;` |
128-
| ¥ | yen | `&yen;` | `&#165;` |
129-
|| euro | `&euro;` | `&#8364;` |
130-
| © | copyright | `&copy;` | `&#169;` |
131-
| ® | registered trademark | `&reg;` | `&#174;` |
132-
|| Indian Rupee | `&inr;` | `&#8377;` |
133-
---
134-
135-
In addition, [numeric character references](https://html.spec.whatwg.org/multipage/syntax.html#syntax-charref) are also supported. Both decimal (`num_dec`) and hexadecimal(`num_hex`).
136-
137-
FXP supports rading Notations and Elements v5.2.1 onwards. However, it doesnt take any decision out of the readed values.
138-
139-
#TODO
140-
In future version of FXP, we'll be supporting more features of DOCTYPE such as `ELEMENT`, reading content for an entity from a file etc.
195+
| | non-breaking space | `&nbsp;` | `&#160;` |
196+
| < | less than | `&lt;` | `&#60;` |
197+
| > | greater than | `&gt;` | `&#62;` |
198+
| & | ampersand | `&amp;` | `&#38;` |
199+
| " | double quotation mark | `&quot;` | `&#34;` |
200+
| ' | single quotation mark | `&apos;` | `&#39;` |
201+
| ¢ | cent | `&cent;` | `&#162;` |
202+
| £ | pound | `&pound;` | `&#163;` |
203+
| ¥ | yen | `&yen;` | `&#165;` |
204+
|| euro | `&euro;` | `&#8364;` |
205+
| © | copyright | `&copy;` | `&#169;` |
206+
| ® | registered trademark | `&reg;` | `&#174;` |
207+
|| Indian Rupee | `&inr;` | `&#8377;` |
208+
209+
In addition, [numeric character references](https://html.spec.whatwg.org/multipage/syntax.html#syntax-charref) are supported - both decimal (`&#123;`) and hexadecimal (`&#x7B;`).
210+
211+
FXP supports reading Notations and Elements from v5.2.1 onwards. However, it doesn't take any action based on these values.
141212

142213
## External Entities
143214

144-
You can set external entities without using DOCTYPE.
215+
You can add external entities programmatically without using DOCTYPE:
145216

146217
```js
147-
const xmlData = `<note>&unknown;&#xD;last</note> `;
218+
const xmlData = `<note>&unknown;&#xD;last</note>`;
148219

149220
const parser = new XMLParser();
150-
parser.addEntity("#xD", "\r"); // &unknown;\rlast
151-
let result = parser.parse(xmlData);
221+
parser.addEntity("#xD", "\r");
222+
let result = parser.parse(xmlData); // Output: &unknown;\rlast
152223
```
153224

154-
This way, you can also override the default entities.
225+
This method also allows you to override default entities.
226+
227+
**Note:** External entities added this way bypass DOCTYPE validation but are still subject to the same security limits when `processEntities: true`.
155228

156-
[> Next: HTML Document Parsing](./6.HTMLParsing.md)
229+
[> Next: HTML Document Parsing](./6.HTMLParsing.md)

lib/fxp.cjs

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

lib/fxp.min.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/fxp.min.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/fxparser.min.js

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

lib/fxparser.min.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)