update strnum to support unicode, discard unsafe doctype entities

Author: amitguptagwl

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion
 
+**5.9.0* (not released yet)
+- update strnum to 2.3.0
+  - you can set hex, binary, enotation, infinity, unicode
+- validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library.
+  User can override rules by overriding EntityDecoder.
+
 **5.8.0 / 2026-05-12*
 - integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
   - This will consider xml-version as well. '1.0' is default

lib/fxp.d.cts

@@ -509,7 +509,9 @@ type strnumOptions = {
   hex: boolean;
   leadingZeros: boolean,
   skipLike?: RegExp,
-  eNotation?: boolean
+  eNotation?: boolean,
+  infinity?: string,
+  unicode?: boolean
 }
 
 type validationOptions = {

package-lock.json

@@ -86,10 +86,11 @@
     }
   ],
   "dependencies": {
-    "@nodable/entities": "^2.1.0",
+    "@nodable/entities": "^2.2.0",
     "fast-xml-builder": "^1.2.0",
+    "is-unsafe": "^1.0.1",
     "path-expression-matcher": "^1.5.0",
-    "strnum": "^2.3.0",
+    "strnum": "^2.4.0",
     "xml-naming": "^0.1.0"
   }
-}
+}

package.json

@@ -24,17 +24,14 @@ describe("unpaired and empty tags", function () {
   });
   fit("bug test", function () {
 
-    const xmlData = `<root><ns:code>safe <ns:code>nested</ns:code> still raw</ns:code></root>`;
-    const options = {
-      stopNodes: ["root.ns::code"],
-      removeNSPrefix: true
-    };
-
-    // const result = XMLValidator.validate(xmlData)
-    const parser = new XMLParser(options);
-    const result = parser.parse(xmlData);
-
-    console.log(result);
+    const xml = `<?xml version="1.0"?>
+<!DOCTYPE foo [
+  <!ENTITY lt "<script>alert(document.domain)</script>">
+]>
+<root>test &lt; value</root>`;
+
+    const result = new XMLParser().parse(xml);
+    console.log(result.root);
     // console.log(JSON.stringify(result, null, 4));
     // expect(result).toEqual(expected);
 

spec/temp.js

@@ -503,7 +503,9 @@ export type strnumOptions = {
   hex: boolean;
   leadingZeros: boolean,
   skipLike?: RegExp,
-  eNotation?: boolean
+  eNotation?: boolean,
+  infinity?: string,
+  unicode?: boolean
 }
 
 export type validationOptions = {

src/fxp.d.ts

@@ -25,7 +25,8 @@ export const defaultOptions = {
   numberParseOptions: {
     hex: true,
     leadingZeros: true,
-    eNotation: true
+    eNotation: true,
+    unicode: false
   },
   tagValueProcessor: function (tagName, val) {
     return val;

src/xmlparser/OptionsBuilder.js

@@ -8,7 +8,9 @@ import toNumber from "strnum";
 import getIgnoreAttributesFn from "../ignoreAttributes.js";
 import { Expression, Matcher } from 'path-expression-matcher';
 import { ExpressionSet } from 'path-expression-matcher';
-import { EntityDecoder, XML, CURRENCY, COMMON_HTML } from '@nodable/entities';
+import { EntityDecoder, XML, CURRENCY, COMMON_HTML, ENTITY_ACTION } from '@nodable/entities';
+import { isUnsafe, VALID_CONTEXTS } from "is-unsafe"
+
 
 // const regx =
 //   '<((!\\[CDATA\\[([\\s\\S]*?)(]]>))|((NAME:)?(NAME))([^>]*)>|((\\/)(NAME)\\s*>))([^<]*)'
@@ -98,7 +100,12 @@ export default class OrderedObjParser {
           maxTotalExpansions: this.options.processEntities.maxTotalExpansions,
           maxExpandedLength: this.options.processEntities.maxExpandedLength,
           applyLimitsTo: this.options.processEntities.appliesTo,
-        }
+        },
+        // onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow',
+        onInputEntity: (name, value) =>
+          isUnsafe(value, [VALID_CONTEXTS.HTML, VALID_CONTEXTS.XML])
+            ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW,
+
         //postCheck: resolved => resolved
       });
     }