Skip to content

Commit d3ca0f2

Browse files
committed
Switch to libxml2-wasm for XML validation
Due to libxmljs2 not being maintained and contained a vulnerability, a replacement needed to be found. This commit replaces it with libxml2-wasm, which is a new, but maintained library, which serves the purpose of validating XML. The implementation is as close the the previous library in regards to flags passed to libxml2, but only adapted to a different interface and the recommendation to dispose all objects. This is my first contribution to this project, and typescript isn't my usual language, so comments are welcome. Resolves: CycloneDX#1079 Signed-off-by: Leon Grave <[email protected]>
1 parent 3fd7dd8 commit d3ca0f2

File tree

5 files changed

+61
-51
lines changed

5 files changed

+61
-51
lines changed

docs/dev/decisions/XmlValidator.md

+6-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ There are several implementations for this:
2222
* [`libxmljs3`](https://www.npmjs.com/package/libxmljs3)
2323
* unmaintained copy of `libxmljs2`
2424
* ! DO NOT USE !
25-
* Any alternative? Please open a pull-request to add them.
25+
* [`libxml2-wasm`](https://www.npmjs.com/package/libxml2-wasm)
26+
* maintained WASM implementation of a libxml2 wrapper
2627

2728
At the moment of writing (2023-04-21),
2829
`libxmljs` and `libxmljs2` are both working on several test environments. Both had the needed capabilities.
@@ -38,6 +39,10 @@ as it was more popular/used and had a more active community.
3839

3940
Decided to replace `libxmljs2`, as it is end of life.
4041

42+
#### 2024-11-26
43+
44+
Decided to replace `libxmljs2` with `libxml2-wasm`, since it's maintained and a functioning XML validator.
45+
4146
## WebBrowsers
4247

4348
there seams to exist no solution for validating XML according to XSD

package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@
8787
"ajv": "^8.12.0",
8888
"ajv-formats": "^3.0.1",
8989
"ajv-formats-draft2019": "^1.6.1",
90-
"libxmljs2": "^0.31 || ^0.32 || ^0.33 || ^0.35",
90+
"libxml2-wasm": "^0.4.1",
9191
"xmlbuilder2": "^3.0.2"
9292
},
9393
"devDependencies": {
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*!
2+
This file is part of CycloneDX JavaScript Library.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
16+
SPDX-License-Identifier: Apache-2.0
17+
Copyright (c) OWASP Foundation. All Rights Reserved.
18+
*/
19+
20+
import { readFile } from 'fs/promises';
21+
import { ParseOption, XmlDocument, XsdValidator } from 'libxml2-wasm';
22+
import { pathToFileURL } from 'url';
23+
24+
import type { ValidationError } from '../../validation/types';
25+
import type { Functionality, Validator } from '../xmlValidator';
26+
27+
/** @internal */
28+
export default (async function (schemaPath: string): Promise<Validator> {
29+
const schema = XmlDocument.fromString(
30+
await readFile(schemaPath, 'utf-8'),
31+
{
32+
option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT,
33+
url: pathToFileURL(schemaPath).toString()
34+
});
35+
const validator = XsdValidator.fromDoc(schema);
36+
37+
return function (data: string): null | ValidationError {
38+
const doc = XmlDocument.fromString(data, { option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT });
39+
let errors = null;
40+
try {
41+
validator.validate(doc);
42+
}
43+
catch (validationErrors) {
44+
errors = validationErrors;
45+
}
46+
47+
doc.dispose();
48+
validator.dispose();
49+
schema.dispose();
50+
51+
return errors;
52+
}
53+
}) satisfies Functionality

src/_optPlug.node/__xmlValidators/libxmljs2.ts

-48
This file was deleted.

src/_optPlug.node/xmlValidator.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ export default opWrapper<Functionality>('XmlValidator', [
2727
/* eslint-disable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports
2828
-- needed */
2929

30-
['libxmljs2', () => require('./__xmlValidators/libxmljs2').default]
30+
['libxml2-wasm', () => require('./__xmlValidators/libxml2-wasm').default]
3131
// ... add others here, pull-requests welcome!
3232

3333
/* eslint-enable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports */

0 commit comments

Comments
 (0)