Repository navigation
Refactor/single xml parser - #1123
Open
deepakprabhakara wants to merge 3 commits into
Open
deepakprabhakara wants to merge 3 commits into
deepakprabhakara wants to merge 3 commits into
Conversation
xmlToObject parses with parseFromString and returns the object shape
xml2js produced with the options this library uses: tag names without
their namespace prefix, attributes under a configurable key ('@' or
'$'), text under '_', a plain string for an element that has only text,
whitespace-only text dropped unless it came from CDATA, and null for an
empty document. With `collapse` it also folds a child that occurs once
into the value itself, the same way response.ts's flattenObject does,
including flattenObject's habit of leaving a single empty child as [''].
parseFromString takes an optional prefix map; xmlToObject uses it to
predeclare xsi and xs, which SAML producers often use on AttributeValue
without declaring. Without it, xmldom rejects such a document with a
NamespaceError where xml2js, which ignores namespaces, accepted it.
Nothing uses xmlToObject yet. Compared with xml2js (and flattenObject
for '@') on the 268 strings the test suite parses, every file under
test/assets and a set of edge cases, the output is identical except
where XML requires normalization xml2js does not do: CRLF/CR become LF
in text, and newlines and tabs in attribute values become spaces.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LkWpdoa6VXK2GbJojJszvV
validate(), parseMetadata(), parseSAMLRequest(), parseLogoutRequest()
and parseLogoutResponse() now read XML through xmlToObject, so the
library has one XML parser. With it go:
- xml2js and @types/xml2js (and sax with them);
- the containsDoctype screen in each of the four xml2js callers and in
validate()'s xmlToJs: parseFromString runs the same check, and throws
the same doctypeNotAllowedError;
- flattenObject: xmlToObject's collapse option produces the same shape
while building it.
Successful results are unchanged. A snapshot of parseMetadata,
parseSAMLRequest, parseLogoutRequest, parseLogoutResponse and
parseIssuer over every file in test/assets and every string the test
suite parses is identical for every input that parses, before and after.
What changes, for the four non-validate() parsers:
- A document with more than one root element is rejected with
multirootedXMLError ("multirooted xml not allowed.").
- An undeclared namespace prefix other than xsi and xs is rejected with
xmldom's NamespaceError.
- Text and attribute values are normalized as XML requires (CRLF to LF;
newlines and tabs in attribute values to spaces).
- A bare "&" followed by whitespace in text is accepted as a literal
"&", as validate() already did.
- Malformed input fails with xmldom's message instead of sax's, for
example "missing root element" instead of "Non-whitespace before
first tag."; four tests that matched sax's wording now match
xmldom's.
The test that relied on the two parsers disagreeing about a bare "&" is
removed; the WrapError path it covered stays covered by the DTD keyword
that sanitizeXML can assemble between validate()'s two parses.
BREAKING CHANGE: parseMetadata(), parseSAMLRequest(),
parseLogoutRequest() and parseLogoutResponse() reject multi-rooted
documents and undeclared namespace prefixes (except xsi and xs), and
report malformed XML with different messages.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LkWpdoa6VXK2GbJojJszvV
deepakprabhakara
added this pull request to stack #1124
October 12, 2026 17:01
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 10 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
xml2js ignored an XML declaration wherever it appeared; xmldom rejects
one that is not the very first thing in the document ("processing
instruction at position N is an xml declaration which is only at the
start of the document"). After b2e7366 (the switch to xmldom),
parseMetadata, parseSAMLRequest and the logout parsers rejected a
document with a newline, a BOM followed by whitespace, or a comment
before the declaration. Pasted or hand-edited metadata often looks like
that, and two of Polis's own metadata fixtures
(test/sso/data/metadata/noentityID and nobinding) start with a comment
and then the declaration; both parse at 44c0bd6 and failed here.
xmlToObject now drops such a misplaced declaration before parsing. The
comment pattern cannot run past its own "-->", so it cannot backtrack
exponentially; a first version that could took seconds on 22 leading
comments, and a test with 40 now pins that.
Found by differential fuzzing against xml2js 0.6.2, which the earlier
checks (the suite's own inputs and test/assets) did not cover.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01LkWpdoa6VXK2GbJojJszvV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.