XMLValidator accepts raw < and & in attribute values #900

• Are you running the latest version?
• Have you included sample input, output, error, and expected output?
• Have you checked if you are using correct configuration?
• Did you try the online tool?
• Have you checked the docs for helpful APIs and examples?

Description

On 5.11.2 (current master at cf66a96), XMLValidator accepts raw ampersands and less-than signs inside quoted attribute values. XML 1.0's AttValue grammar excludes both literal characters there; an ampersand must begin a reference. This concerns attribute values, whereas #214 reported a stray ampersand in element text.

Input

<a x="&"/>
<a x="<"/>
<a x="&amp;"/>

The last input is a valid control.

Code

const { XMLParser, XMLValidator } = require('fast-xml-parser');

for (const xml of ['<a x="&"/>', '<a x="<"/>', '<a x="&amp;"/>']) {
  console.log(xml, XMLValidator.validate(xml));
}
console.log(new XMLParser({ ignoreAttributes: false }).parse('<a x="&"/>', true));

Output

XMLValidator.validate returns true for all three inputs. Parsing the raw-ampersand input with validation enabled returns { a: { '@_x': '&' } }. The official online validator also reports "Valid XML" for both malformed inputs.

Expected data

The first two inputs should return a validation error, and parse(xml, true) should reject them. The escaped control should remain valid. The attribute token scanner extracts the quoted value, but validateAttributeString does not check that value for raw '<' or malformed '&' references.

Would you like to work on this issue?

• Yes
• No