dylang / node-xml Goto Github PK

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@Cl0wnK1n9) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

The package claims that is needs no depenencies:
https://www.npmjs.com/package/xml

But I believe it rely on on Stream
https://www.npmjs.com/package/xml

Would be nice if newline was \r\n on windows so that the resultant xml created was readable with notepad and other basic windows editors/cmd line. Even nicer would be the ability to specify what to use for newline in the options

examples:

var winXml = require('xml')(myXmlJsonTemplate, {indent: '\t', newline:'\r\n'});
var macXml = require('xml')(myXmlJsonTemplate, {indent: '\t', newline:'\n'});

If no newline specified, '\r\n' would be used as default newline if process.platform === 'win32' otherwise '\n'.

Some might consider this request nitpicky or even counterproductive (as the xml generated would be slightly different depending on platform) and I can see that point of view. But on the other hand it would be super handy for quick viewing on windows.

I'll be happy to implement it and submit it as a pull request if you don't want to make the changes; but I didn't want to waste time on it if the idea would be rejected outright. Let me know. Thanks!

Hi,

I'm facing you with an issue I've encountered. Here is a representation of my object:

{
    "root": {
        "name": "pool-name",
        "path": "/tmp/pool/path",
        "object": {
            "number": 1,
            "string": "string",
            "array": ["a", "b",  "c", "d"]
        }
    }
}

and the way I wrap it in order to work with your xml convertor.:

[
    {
        "root": [
            {
                "name": {
                    "_cdata": "pool-name"
                }
            },
            {
                "path": {
                    "_cdata": "/tmp/pool/path"
                }
            },
            {
                "object": [
                    {
                        "number": {
                            "_cdata": 1
                        }
                    },
                    {
                        "string": {
                            "_cdata": "string"
                        }
                    },
                    {
                        "array": [
                            {
                                "0": {
                                    "_cdata": "a"
                                }
                            },
                            {
                                "1": {
                                    "_cdata": "b"
                                }
                            },
                            {
                                "2": {
                                    "_cdata": "c"
                                }
                            },
                            {
                                "3": {
                                    "_cdata": "d"
                                }
                            }
                        ]
                    }
                ]
            }
        ]
    }
]

which will obviously convert to this:

<root>
    <name><![CDATA[pool-name]]></name>
    <path><![CDATA[/tmp/pool/path]]></path>
    <object>
        <number><![CDATA[1]]></number>
        <string><![CDATA[string]]></string>
        <array>
            <0><![CDATA[a]]></0>
            <1><![CDATA[b]]></1>
            <2><![CDATA[c]]></2>
            <3><![CDATA[d]]></3>
        </array>
    </object>
</root>

However, <0> is not an XML valid tag.

I don't know whether to consider this an issue for the xml convertor, or for the way I wrap the object I'm trying to convert.

Any ideas ?

xml({ foo: null }) works fine, but xml({ bar: [ null, null ] }) causes the program to crash. I know it seems like an edge case, but I am converting a JSON document from a database query and some documents contain arrays with null elements.

Here is the stack trace:

events.js:160
throw er; // Unhandled 'error' event
^
TypeError: Cannot convert undefined or null to object
at /x/node_modules/xml/lib/xml.js:185:44
at Array.forEach (native)
at resolve (/x/node_modules/xml/lib/xml.js:183:24)
at add (/x/node_modules/xml/lib/xml.js:47:24)
at xml (/x/node_modules/xml/lib/xml.js:89:9)
at [REDACTED]
at Query. (/x/node_modules/mongoose/lib/model.js:3340:16)
at /x/node_modules/kareem/index.js:259:21
at /x/node_modules/kareem/index.js:127:16
at _combinedTickCallback (internal/process/next_tick.js:67:7)
at process._tickCallback (internal/process/next_tick.js:98:9)

indentation of

{guid:[{_attr:{premalink:true}},'content']}

shoud be

<guid premalink="true">content</guid>

unit test :

expect(xml({guid:[{_attr:{premalink:true}},'content']},true)).to.equal('<guid premalink="true">content</guid>');

are there any plans to implement a xml stream api via eventemitter?
for example to send xml files to the client while generating.

xml([ { a: [ { foo1: '' }, { bar1: '' }, 'textNode', { foo2: '' }, 'textNode2', { bar2: '' } ] } ])

should be

<a><foo1></foo1>textNode<foo2></foo2>textNode2<bar2></bar2></a>

but instead is

<a><foo1></foo1>textNodetextNode2<bar2></bar2></a>

Hi

I want to stream SON object to xml file using writable stream...
However, the readable stream never seems to emit 'end' event...

Perhaps I am doing something wrong, but here is the bit I am trying

var   fs = require('fs')
    , path = require('path')
    , xml = require('xml');

var sample =
    {
        samples: [
            { sample: [{ "id": 1 }, { "gender": "Male" }, { "first_name": "Earl"  }, { "last_name": "Garza"   }, { "email": "[email protected]" }, { "ip_address": "0.152.7.89" }   ]},
            { sample: [{ "id": 2 }, { "gender": "Male" }, { "first_name": "David" }, { "last_name": "Alvarez" }, { "email": "[email protected]" }, { "ip_address": "170.10.118.74"} ]},
            { sample: [{ "id": 3 }, { "gender": "Male" }, { "first_name": "David" }, { "last_name": "Gray"    }, { "email": "[email protected]"  }, { "ip_address": "42.46.52.27" }  ]}
        ]
    };


var writer = fs.createWriteStream(path.join(__dirname, "data.xml"));
var xmlStream = xml(sample, { indent: true, declaration: true, stream: true });

xmlStream.on("data", function (chunk) {
    console.log('got %d bytes of data', chunk.length);
});

xmlStream.on("end", function () {
    // never gets here...
    console.log('there will be no more data.');
    // do I need to signal the writer here?
    //writer.end();
});

// make sure file descriptor is closed in case of an error
writer.on('error', function (err) {
    console.log(err);
    writer.end();
});

writer.on('finish', function () {
    console.log("done writing the file! Now I can do something with it!!!");
});

console.log('Piping xml data...');
xmlStream.pipe(writer);   // save xml data to file...

return;

The following is modified example from the readme:

var example5 = [{
    toys: [{
            _attr: {
                decade: '80s',
                locale: 'US'
            }
        },
        {
            toy: [{
                    _attr: {
                        decade: '80s',
                        locale: 'US'
                    }
                },
                'Transformers',
                {
                    toya: [{
                        _attr: {
                            knowing: 'half the battle'
                        }
                    }, 'GI Joe']
                }
            ]
        }
    ]
}];

And it produces

<toys decade="80s" locale="US">
    <toy decade="80s" locale="US">
        Transformers
        <toya knowing="half the battle">GI Joe</toya>
    </toy>
</toys>

However, if another piece of mixed data is added like this:

var example5 = [{
    toys: [{
            _attr: {
                decade: '80s',
                locale: 'US'
            }
        },
        {
            toy: [{
                    _attr: {
                        decade: '80s',
                        locale: 'US'
                    }
                },
                'Transformers',
                {
                    toya: [{
                        _attr: {
                            knowing: 'half the battle'
                        }
                    }, 'GI Joe']
                },
                ' and the A-team'
            ]
        }
    ]
}];

The sub object is just ignored and the following is outputted:

<toys decade="80s" locale="US">
    <toy decade="80s" locale="US">Transformers and the A-team</toy>
</toys>

Processing instructions which begin with '?' are incorrectly closed with a trailing '/' instead of a '?' as outlined https://www.w3.org/TR/xml11/#sec-pi.

Fixed in #29

It would great to be able to generate xml including the declaration
e.g

<?xml version="1.0" encoding="UTF-8"?>

Hi,
I have multiple input to xml. When I close on of the input stream, closing other has no effect. I dont get the closing tag for the last element

kml = xml.element({ _attr: { xmlns: 'http://www.opengis.net/kml/2.2'} });
doc = xml.element({})

stream = xml([{kml: kml}, {Document: doc}], {declaration: true})

stream.on 'data', (chunk) ->
  console.log(chunk);

doc.close()
kml.close()

And here is the output

<?xml version="1.0" encoding="UTF-8"?><kml xmlns="http://www.opengis.net/kml/2.2">
<Document>
</Document>

Closign tag for kml is missing

I can't seem to find a way of including a doctype in an outputted document.

For example here (http://wiki.xmltv.org/index.php/XMLTVFormat):

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE tv SYSTEM "xmltv.dtd">

<tv>...</tv>

I am going to send XML response from my node js api.

When I am sending data like following

res.set('Content-Type', 'text/xml');

let example5 = [
  {
    toys: [
      {
        _attr: {
          decade: '80s',
          locale: 'US'
        }
      },
      {
        toy: 'Transformers'
      },
      {
        toy: [
          {
            _attr: {
              knowing: 'half the battle'
            }
          },
          'GI Joe'
        ]
      },
      {
        toy: [
          {
            name: 'He-man'
          },
          {
            'g:brand': 'He-man'
          },
          {
            description: {
              _cdata: '<strong>Master of the Universe!</strong>'
            }
          }
        ]
      }
    ]
  }
]

return res.send(xml(example5, true));

When using the key with : it is giving error like this

When creating an xmlElement right before a textNode on the same level it is ignored.

xml(
    {
        test:[
            {'foo1':''},
            {'bar1':''},
            'textNode',
            {'foo2':''},
            {'bar2':''}
        ]
    }
)

Yields the result

<test><foo1></foo1>textNode<foo2></foo2><bar2></bar2></test>

Notice the lack of bar1

I ran this,

let example3 = { annotation: {xxx: '1111', arr: [ { toy: 'Transformers' } , { toy: 'GI Joe' }, { toy: 'He-man' } ]} };
let result1 = xml(example3, {indent: '\t'})

and the result1 was:
'<annotation/>'

Hello! Thx for your package! Could you please tell, how I could create such tag
SOAP-ENV:Header/

I tried { 'SOAP-ENV:Header': [] },but it becomes
SOAP-ENV:Header
</SOAP-ENV:Header>
Not self-closing tag

Is there any way to create a xml element with namespace? For example:

<root xmlns:h="http://www.w3.org/TR/html4/">
  <h:table>My table</h:table>
</root>

i don't know what the problem is exactly, but i'm not getting expected results. here's what i see in a simple test.

any help would be greatly appreciated. thank you.

This is not a criticism of your work, its great, but just something I don't understand. I'm so confused as to why when someone develops a JSON and XML converter that they don't create the other conversion. So all the community has a JSON to XML parser and a XML to JOSN parser that don't work together. Do you know of any interchangeable parsers? Your library on npm is just xml and it should really be the one that does both.

Any ideas how you could create xml elements and attributes with dashes in the name?

Eg.

<test-element test-id="test"></test-element>

Hey there, just wondering if you could add an option to prettify the xml that is spit out of this tool?

Thanks so much!

Why does it not close empty tag?

I made a commit with jsdoc typing and replacing vars with consts and lets. But can't push to the remote.
Please, allow contributing to the project.

I am trying to include my xsl stylesheet but somehow it doesn't work.

My code:

xml(
    {
      "?xml-stylesheet": [{ _attr: { type: "text/xsl", href: "sitemap.xsl" } }],
      sitemapindex: [
        { _attr: { xmlns: "http://www.sitemaps.org/schemas/sitemap/0.9" } },
        { sitemap: [
          { loc: "https://nextjs.marcofranssen.nl/blog-sitemap.xml" }, 
          { lastmod: new Date().toISOString() },
        ]
      ],
    },
    { declaration: true }
)

Result:

<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet type="text/xsl" href="sitemap.xsl"></?xml-stylesheet>

Expected:

<?xml version="1.0" encoding="UTF-8"?><?xml-stylesheet type="text/xsl" href="sitemap.xsl"?>
<sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <sitemap>
    <loc>https://nextjs.marcofranssen.nl/blog-sitemap.xml</loc>
    <lastmod>2021-01-24T12:55:02.245Z</lastmod>
  </sitemap>
</sitemapindex>

Streams are only supposed to emit the 'end' event after all 'data' events are emitted. Unfortunately, the data is all being emitted after the 'end' event is emitted which renders a stream approach completely useless. You have no way of knowing the outputted xml object is done being generated short of forcing a timeout. The main culprit can be found in end() starting on line 50 of xml.js. I considered fixing it, but the entire stream implementation seems to be hacked together and I don't feel like reworking all of the logic to make a proper stream implementation. Going to cut over and just pass it the full object and avoid the streams.