XMLValidator accepts a literal ]]> in element text #901

• Are you running the latest version?
• Have you included sample input, output, error, and expected output?
• Have you checked if you are using correct configuration?
• Did you try the online tool?
• Have you checked the docs for helpful APIs and examples?

Description

On 5.11.2 (current master at cf66a9658004553bc740616e6c7a4912e7e9aab6), XMLValidator accepts a literal ]]> in element text. The XML 1.0 CharData grammar excludes that sequence except when it closes a CDATA section.

Input

<a>]]></a> is the invalid input. <a>]]&gt;</a> is a valid control representing the same text.

Code

const { XMLParser, XMLValidator } = require('fast-xml-parser');
for (const xml of ['<a>]]></a>', '<a>]]&gt;</a>']) {
  console.log(xml, XMLValidator.validate(xml));
  console.log(new XMLParser().parse(xml, true));
}

Output

Both inputs return true from XMLValidator.validate; both parse with validation enabled as { a: ']]>' }. The online validator also reports “Valid XML” for the raw input. Python xml.etree.ElementTree rejects the raw input with ParseError at column 5 and accepts the escaped control.

Expected data

The raw delimiter should be rejected by validation (including parsing with validation=true), while the escaped control should remain valid.

Would you like to work on this issue?

• Yes
• No