Skip to content

JS prototype chain properties should not be treated as entities #370

Description

@karfau

Source code using in instead of Object.hasOwnProperty:

xmldom/lib/sax.js

Lines 68 to 69 in 40745c6

if(k in entityMap){
return entityMap[k];

import { DOMParser, XMLSerializer } from '@xmldom/xmldom';

const source = `<xml>&hasOwnProperty; &__proto__; &constructor;</xml>`;

const doc = new DOMParser({ errorHandler: console.error }).parseFromString(
  source,
  'text/xml'
);
console.log(
  doc.documentElement.toString()
);

leads to the output
<xml>function hasOwnProperty() { [native code] </xml>

Try it: https://stackblitz.com/edit/js-xmldom370?devtoolsheight=33&file=index.js

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    Done

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions