XMLValidator accepts references, CDATA, and DOCTYPE after the root element #899

• Are you running the latest version?
• Have you included sample input, output, error, and expected output?
• Have you checked if you are using correct configuration?
• Did you try the online tool?
• Have you checked the docs for helpful APIs and examples?

Description

On 5.11.2 (current master at cf66a96), XMLValidator accepts character references, CDATA, and a DOCTYPE after a completed root element. With validation enabled, XMLParser.parse then either drops that content or returns it as top-level text. XML 1.0 permits only whitespace, comments, and processing instructions in the epilog: document grammar and Misc grammar.

Input and code

Using the default options with Node 24.22.1:

const { XMLParser, XMLValidator } = require('fast-xml-parser');

for (const xml of [
  '<a></a>&amp;',
  '<a></a>&#65;',
  '<a></a><![CDATA[x]]>',
  '<a></a><!DOCTYPE x>',
]) {
  console.log(xml, XMLValidator.validate(xml));
}
console.log(new XMLParser().parse('<a></a><![CDATA[x]]>', true));

Output

Each validation returns true. The final parse returns { a: '', '#text': 'x' }. Parsing <a></a>&amp; with validation returns { a: '' }, dropping the trailing reference. The official online validator also reports "Valid XML" for all four inputs.

As a control, <a></a>tail returns InvalidXml: Extra text at the end. An epilog comment or processing instruction passes validation, as expected.

Expected data

All four inputs should fail validation because those constructs occur after the document element. XMLParser.parse(xml, true) should then reject them too. The reachedRoot check appears to be bypassed while scanning references and '<!...>' markup after the root.

Would you like to work on this issue?

• Yes
• No