All Commits

0.9.9

Added

• implement ParentNode.children getter #960 / #410

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains #931

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you,
@stevenobiajulu,
@yoshi389111,
@thesmartshadow,
for your contributions

0.9.8

Fixed

• fix: replace \u2029 as part of normalizeLineEndings #839 / #838
• perf: speed up line detection #847 / #838

Chore

• updated dependencies
• drop jazzer and rxjs devDependencies #845

Thank you,
@kboshold,
@Ponynjaa,
for your contributions.

0.9.7

Added

• Implementation of hasAttributes #804

Fixed

• locator is now true even when other options are being used for the DOMParser #802 / #803
• allow case-insensitive DOCTYPE in HTML #817 / #819

Performance

• simplify DOM.compareDocumentPosition #805

Chore

• updated devDependencies

Thank you,
@zorkow,
@Ponynjaa,
@WesselKroos,
for your contributions.

0.9.6

Fixed

• lower error level for unicode replacement character #790 / #794 / #797

Chore

• updated devDependencies
• migrate renovate config #792

Thank you, @eglitise, for your contributions.

0.9.5

Fixed

• fix: re-index childNodes on insertBefore #763 / #766

Thank you,
@mureinik,
for your contributions.

0.9.4

Fixed

• restore performance for large amount of child nodes #748 / #760
• types: correct error handler level to warning (fix(types): correct error handler level to warning #759) #754 / #759

Docs

• test: verify BOM handling #758

Thank you, @luffynando, @mattiasw, @JoinerDev, for your contributions.

0.9.3

Fixed

• restore more Node and ProcessingInstruction types #725 / #726
• getElements* methods return LiveNodeList<Element> #731 / #734
• Add more missing Node props #728, triggered by unclosed #724

Docs

• Update supported runtimes in readme (NodeJS >= 14.6 and other ES5 compatible runtimes)

Chore

• updates devDependencies

Thank you, @Ponynjaa, @ayZagen, @sserdyuk, @wydengyre, @mykola-mokhnach, @benkroeger, for your contributions.

0.9.2

Feature

• add Element.getElementsByClassName #722

Fixed

• add missing types for Document.documentElement and Element.tagName #721 #720

Thank you, @censujiang, @Mathias-S, for your contributions

0.9.1

Fixed

• DOMParser.parseFromString requires mimeType as second argument #713
• correct spelling of isHTMLMimeType in type definition #715 / #712
• sync types with exports #717 / #285 / #695

Other

• minimum tested node version is 14 #710

Thank you, @krystofwoldrich, @marvinruder, @amacneil, @defunctzombie, @tjhorner, @danon, for your contributions.

0.9.0

Summary on dev.to

Features

• feat: expose all DOM level 2 element prototypes #637 / #40
• feat: add iterator function to NodeList and NamedNodeMap #634 / #633

Fixed

• parse empty/whitspace only doctype internal subset #692
• avoid prototype clash in namespace prefix #554
• report fatalError when doctype is inside elements #550

Other

• test: add fuzz target and regression tests #556
• chore: improve .gitignore and provide .envrc.template #697
• chore: Apply security best practices #546
• ci: check test coverage in PRs #524
• docs: add missing commas to readme #566
• docs: click to copy install command in readme #644
• docs: enhance jsdoc comments #511

Thank you, @kboshold, @edi9999, @apupier, @shunkica, @homer0, @jhauga, @UdayKharatmol, for your contributions

0.9.0-beta.11

Fixed

• report more non well-formed cases #519 / #45 / #125 / #467
  BREAKING-CHANGE: Reports more not well-formed documents as fatalError
  and drop broken support for optional and unclosed tags in HTML.

Other

• Translate/drop non English comments #518
• use node v16 for development #517

Thank you, @brodybits, @cbettinger, @josecarlosrx, for your contributions

0.9.0-beta.10

Fixed

• dom: prevent iteration over deleted items #514/ #499

Chore

• use prettier plugin for jsdoc #513

Thank you, @qtow, @shunkica, @homer0, for your contributions

0.9.0-beta.9

Fixed

• Set nodeName property in ProcessingInstruction #509 / #505
• preserve DOCTYPE internal subset #498 / #497 / #117
  BREAKING CHANGES: Many documents that were previously accepted by xmldom, esecially non well-formed ones are no longer accepted. Some issues that were formerly reported as errors are now a fatalError.
• DOMParser: Align parseFromString errors with specs #454

Chore

• stop running mutation tests using stryker #496
• make toErrorSnapshot windows compatible #503

Thank you, @cjbarth, @shunkica, @pmahend1, @niklasl, for your contributions

0.9.0-beta.8

Fixed

• Throw DOMException when calling removeChild with invalid parameter #494 / #135

BREAKING CHANGE: Previously it was possible (but not documented) to call Node.removeChild with any node in the tree,
and with certain exceptions, it would work. This is no longer the case: calling Node.removeChild with an argument that is not a direct child of the node that it is called from, will throw a NotFoundError DOMException, as it is described by the specs.

Thank you, @noseworthy, @davidmc24, for your contributions

0.9.0-beta.7

Feature

• Add compareDocumentPosition method from level 3 spec. #488

Fixed

• getAttribute and getAttributeNS should return null (fix: getAttribute and getAttributeNS should return null #477) #46
• several issues in NamedNodeMap and Element (fix: several issues in NamedNodeMap and Element #482) #46
• properly parse closing where the last attribute has no value #485 / #486
• extend list of HTML entities #489

BREAKING CHANGE: Iteration over attributes now happens in the right order and non-existing attributes now return null instead of undefined. THe same is true for the namepsaceURI and prefix of Attr nodes.
All of the changes are fixing misalignment with the DOM specs, so if you expected it to work as specified,
nothing should break for you.

Chore

• update multiple devDependencies
• Configure jest (correctly) and wallaby #481 / #483

Thank you, @bulandent, @zorkow, for your contributions

0.9.0-beta.6

Fixed

• Properly check nodes before replacement #457 / #455 / #456

Thank you, @edemaine, @pedro-l9, for your contributions

0.9.0-beta.5

Fixed

• fix: Restore ES5 compatibility #452 / #453

Thank you, @fengxinming, for your contributions

0.9.0-beta.4

Fixed

• Security: Prevent inserting DOM nodes when they are not well-formed CVE-2022-39353
  In case such a DOM would be created, the part that is not well-formed will be transformed into text nodes, in which xml specific characters like < and > are encoded accordingly.
  In the upcoming version 0.9.0 those text nodes will no longer be added and an error will be thrown instead.
  This change can break your code, if you relied on this behavior, e.g. multiple root elements in the past. We consider it more important to align with the specs that we want to be aligned with, considering the potential security issues that might derive from people not being aware of the difference in behavior.
  Related Spec: https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity

Chore

• update multiple devDependencies
• Add eslint-plugin-node for lib #448 / #190
• style: Apply prettier to all code #447 / #29 / #130

Thank you, @XhmikosR, @awwright, @frumioj, @cjbarth, @markgollnick for your contributions

0.9.0-beta.3

Fixed

• fix: Stop adding tags after incomplete closing tag #445 / #416
  BREAKING CHANGE: It no longer reports an error when parsing HTML containing incomplete closing tags, to align the behavior with the one in the browser.
  BREAKING CHANGE: If your code relied on not well-formed XML to be parsed and include subsequent tags, this will no longer work.
• fix: Avoid bidirectional characters in source code #440

Other

• ci: Add CodeQL scan #444

Thank you, @ACN-kck, @mgerlach for your contributions

0.9.0-beta.2

Fixed

• Avoid iterating over prototype properties #437 / #436

Thank you, @Supraja9726 for your contributions

0.9.0-beta.1

Fixed

Only use HTML rules if mimeType matches #338, fixes #203

In the living specs for parsing XML and HTML, that this library is trying to implement,
there is a distinction between the different types of documents being parsed:
There are quite some rules that are different for parsing, constructing and serializing XML vs HTML documents.

So far xmldom was always "detecting" whether "the HTML rules should be applied" by looking at the current namespace. So from the first time an the HTML default namespace (http://www.w3.org/1999/xhtml) was found, every node was treated as being part of an HTML document. This misconception is the root cause for quite some reported bugs.

BREAKING CHANGE: HTML rules are no longer applied just because of the namespace, but require the mimeType argument passed to DOMParser.parseFromString(source, mimeType) to match 'text/html'. Doing so implies all rules for handling casing for tag and attribute names when parsing, creation of nodes and searching nodes.

BREAKING CHANGE: Correct the return type of DOMParser.parseFromString to Document | undefined. In case of parsing errors it was always possible that "the returned Document" has not been created. In case you are using Typescript you now need to handle those cases.

BREAKING CHANGE: The instance property DOMParser.options is no longer available, instead use the individual readonly property per option (assign, domHandler, errorHandler, normalizeLineEndings, locator, xmlns). Those also provides the default value if the option was not passed. The 'locator' option is now just a boolean (default remains true).

BREAKING CHANGE: The following methods no longer allow a (non spec compliant) boolean argument to toggle "HTML rules":

• XMLSerializer.serializeToString
• Node.toString
• Document.toString

The following interfaces have been implemented:
DOMImplementation now implements all methods defined in the DOM spec, but not all of the behavior is implemented (see docstring):

• createDocument creates an "XML Document" (prototype: Document, property type is 'xml')
• createHTMLDocument creates an "HTML Document" (type/prototype: Document, property type is 'html').
  • when no argument is passed or the first argument is a string, the basic nodes for an HTML structure are created, as specified
  • when the first argument is false no child nodes are created

Document now has two new readonly properties as specified in the DOM spec:

• contentType which is the mime-type that was used to create the document
• type which is either the string literal 'xml' or 'html'

MIME_TYPE (/lib/conventions.js):

• hasDefaultHTMLNamespace test if the provided string is one of the miem types that implies the default HTML namespace: text/html or application/xhtml+xml

Thank you @weiwu-zhang for your contributions

Chore

• update multiple devDependencies

0.9.10

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you,
@Jvr2022,
@praveen-kv,
@TharVid,
@decsecre583,
@tlsbollei,
@KarimTantawey,
for your contributions