XMLValidator accepts double hyphens inside comments #903

• Are you running the latest version? (5.11.2, master at cf66a9658004553bc740616e6c7a4912e7e9aab6)
• Have you included sample input, output, error, and expected output?
• Have you checked if you are using correct configuration? (default options)
• Did you try online tool? (it reports Valid XML for the 22-byte sample)
• Have you checked the docs for helpful APIs and examples?

Description

XMLValidator.validate accepts a comment containing -- before the closing delimiter. XML 1.0 comments cannot contain a double hyphen within the comment text. Python xml.etree.ElementTree rejects the same input as not well-formed at column 12.

Input

<a><!--foo--bar--></a>

Code

const { XMLValidator, XMLParser } = require("./lib/fxp.cjs");
for (const xml of ["<a><!--foo--bar--></a>", "<a><!--ok--></a>"]) {
  console.log(xml, XMLValidator.validate(xml), new XMLParser().parse(xml, true));
}

Output

Both inputs return true from XMLValidator.validate and parse as { a: "" }. The online tool also reports Valid XML for the malformed sample.

Expected data

The malformed comment should be rejected; <a><!--ok--></a> should remain valid.

Would you like to work on this issue?

• Yes
• No