You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+6Lines changed: 6 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,11 @@
1
1
<small>Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.</small>
2
2
3
+
**5.3.6 / 2026-02-14**
4
+
- Improve security and performance of entity processing
5
+
- new options `maxEntitySize`, `maxExpansionDepth`, `maxTotalExpansions`, `maxExpandedLength`, `allowedTags`,`tagFilter`
6
+
- fast return when no edtity is present
7
+
- improvement replacement logic to reduce number of calls
Copy file name to clipboardExpand all lines: docs/v4/2.XMLparseOptions.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -691,7 +691,12 @@ const XMLdata = `
691
691
```
692
692
693
693
## processEntities
694
-
Set it to `true` (default) to process default and DOCTYPE entities. Check [Entities](./5.Entities.md) section for more detail. If you don't have entities in your XML document then it is recommended to disable it `processEntities: false` for better performance.
694
+
- false (Recommended): The parser will recognize the `<!DOCTYPE>` and `<!ENTITY>` tags but will not perform any string substitution. This prevents Entity Expansion (DoS) attacks while allowing the rest of the XML to be parsed normally, even if the DOCTYPE internal subset is complex.
695
+
696
+
- true: The parser will actively replace all `&entity;` references with their defined values. Use with caution: only enable this for trusted XML sources to avoid resource exhaustion.
697
+
698
+
heck [Entities](./5.Entities.md) section for more detail.
699
+
695
700
## removeNSPrefix
696
701
697
702
Remove namespace string from tag and attribute names.
This would be blocked at the entity definition stage or during expansion, preventing resource exhaustion.
107
+
108
+
## XML Builder
109
+
110
+
XML Builder decodes default entities automatically. Eg:
33
111
34
-
XML Builder decodes default entities value. Eg
35
112
```js
36
113
constjsObj= {
37
-
"note": {
38
-
"@heading":"Reminder > \"Alert",
39
-
"body": {
40
-
"#text":" 3 < 4",
41
-
"attr":"Writer: Donald Duck."
42
-
},
43
-
}
44
-
};
45
-
46
-
constoptions= {
47
-
attributeNamePrefix:"@",
48
-
ignoreAttributes:false,
49
-
// processEntities: false
50
-
};
51
-
constbuilder=newXMLBuilder(options);
52
-
constoutput=builder.build(jsObj);
114
+
"note": {
115
+
"@heading":"Reminder > \"Alert",
116
+
"body": {
117
+
"#text":" 3 < 4",
118
+
"attr":"Writer: Donald Duck."
119
+
},
120
+
}
121
+
};
122
+
123
+
constoptions= {
124
+
attributeNamePrefix:"@",
125
+
ignoreAttributes:false,
126
+
};
127
+
constbuilder=newXMLBuilder(options);
128
+
constoutput=builder.build(jsObj);
53
129
```
130
+
54
131
Output:
55
132
```xml
56
133
<noteheading="Reminder >"Alert">
@@ -61,9 +138,9 @@ Output:
61
138
</note>
62
139
```
63
140
64
-
## Side effects
141
+
## Side Effects
65
142
66
-
Though FXP doesn't silently ignores entities with `&` in the values, following side effects are possible
143
+
FXP silently ignores entities with `&` in their values for security. However, be aware of how multiple entities interact:
67
144
68
145
```xml
69
146
<?xml version="1.0" encoding="UTF-8"?>
@@ -81,10 +158,10 @@ Though FXP doesn't silently ignores entities with `&` in the values, following s
81
158
</note>
82
159
```
83
160
84
-
Output
161
+
Output:
85
162
86
163
```js
87
-
{
164
+
{
88
165
"note": {
89
166
"heading":"Reminder",
90
167
"body": {
@@ -96,61 +173,57 @@ Output
96
173
}
97
174
```
98
175
99
-
To deal with such situation, use `&`instead of `&` in XML document.
176
+
To deal with literal ampersands, use `&`in your XML document.
100
177
101
-
## Attacks
178
+
## Security Note
102
179
103
-
Following attacks are possible due to entity processing
180
+
While FXP blocks many entity-based attacks through its security limits and by rejecting entities with `&` in values, the following attack vectors are mitigated:
104
181
105
-
* Denial-of-Service Attacks
106
-
* Classic XXE
107
-
* Advanced XXE
108
-
* Server-Side Request Forgery (SSRF)
109
-
* XInclude
110
-
* XSLT
182
+
***Denial-of-Service Attacks:** Blocked by size and expansion limits
183
+
***Classic XXE:** External entities are not supported
184
+
***Parameter Entities:** Automatically ignored
185
+
***Recursive Entities:** Blocked by refusing entities containing `&`
111
186
112
-
Since FXP doesn't allow entities with `&` in the values, above attacks should not work.
187
+
**When `processEntities: false`:** All entity expansion is disabled, providing maximum security for untrusted XML.
113
188
114
189
## HTML Entities
115
190
116
-
Following HTML entities are supported by the parser by default when `htmlEntities: true`.
191
+
Following HTML entities are supported when `htmlEntities: true`:
117
192
118
193
| Result | Description | Entity Name | Entity Number |
In addition, [numeric character references](https://html.spec.whatwg.org/multipage/syntax.html#syntax-charref) are also supported. Both decimal (`num_dec`) and hexadecimal(`num_hex`).
136
-
137
-
FXP supports rading Notations and Elements v5.2.1 onwards. However, it doesnt take any decision out of the readed values.
138
-
139
-
#TODO
140
-
In future version of FXP, we'll be supporting more features of DOCTYPE such as `ELEMENT`, reading content for an entity from a file etc.
In addition, [numeric character references](https://html.spec.whatwg.org/multipage/syntax.html#syntax-charref) are supported - both decimal (`{`) and hexadecimal (`{`).
210
+
211
+
FXP supports reading Notations and Elements from v5.2.1 onwards. However, it doesn't take any action based on these values.
141
212
142
213
## External Entities
143
214
144
-
You can set external entities without using DOCTYPE.
215
+
You can add external entities programmatically without using DOCTYPE:
145
216
146
217
```js
147
-
constxmlData=`<note>&unknown;
last</note>`;
218
+
constxmlData=`<note>&unknown;
last</note>`;
148
219
149
220
constparser=newXMLParser();
150
-
parser.addEntity("#xD", "\r");// &unknown;\rlast
151
-
let result =parser.parse(xmlData);
221
+
parser.addEntity("#xD", "\r");
222
+
let result =parser.parse(xmlData);// Output: &unknown;\rlast
152
223
```
153
224
154
-
This way, you can also override the default entities.
225
+
This method also allows you to override default entities.
226
+
227
+
**Note:** External entities added this way bypass DOCTYPE validation but are still subject to the same security limits when `processEntities: true`.
155
228
156
-
[> Next: HTML Document Parsing](./6.HTMLParsing.md)
229
+
[> Next: HTML Document Parsing](./6.HTMLParsing.md)
0 commit comments