[CVE-2022-39353] Vulnerability in xmldom-instawork about hyperview HOT 2 CLOSED

Some exploration of changes that may not be backwards compatible, we will need to investigate more:

xmldom changes:

https://github.com/xmldom/xmldom/releases/tag/0.5.0

• Improve error reporting; throw on duplicate attribute
• BREAKING CHANGE: It is currently not clear how to consistently deal with duplicate attributes, so it's also safer for our users to fail when detecting them.
• It's possible to configure the DOMParser.errorHandler before parsing, to handle those errors differently.

https://github.com/xmldom/xmldom/releases/tag/0.8.0

• Normalize all line endings according to XML specs 1.0 and 1.1
• BREAKING CHANGE: Certain combination of line break characters are normalized to a single \n before parsing takes place and will no longer be preserved.
• #303 / #307
• #49, #97, #324 / #314
• XMLSerializer: Preserve whitespace character references #284 / #310
• BREAKING CHANGE: If you relied on the not spec compliant preservation of literal \t, \n or \r in attribute values.
• To preserve those you will have to create XML that instead contains the correct numerical (or hexadecimal) equivalent (e.g. , , ).
• Drop deprecated exports DOMImplementation and XMLSerializer from lib/dom-parser.js #53 / #309
• BREAKING CHANGE: Use the one provided by the main package export.
• dom: Remove all links as part of removeChild #343 / #355

https://github.com/xmldom/xmldom/releases/tag/0.9.0-beta.1

• BREAKING CHANGE: Correct the return type of DOMParser.parseFromString to Document | undefined. In case of parsing errors it was always possible that "the returned Document" has not been created. In case you are using Typescript you now need to handle those cases.
• BREAKING CHANGE: The instance property DOMParser.options is no longer available, instead use the individual readonly property per option (assign, domHandler, errorHandler, normalizeLineEndings, locator, xmlns). Those also provides the default value if the option was not passed. The 'locator' option is now just a boolean (default remains true).

https://github.com/xmldom/xmldom/releases/tag/0.7.7

• Security: Prevent inserting DOM nodes when they are not well-formed CVE-2022-39353
• In case such a DOM would be created, the part that is not well-formed will be transformed into text nodes, in which xml specific characters like < and > are encoded accordingly.
• In the upcoming version 0.9.0 those text nodes will no longer be added and an error will be thrown instead.
• This change can break your code, if you relied on this behavior, e.g. multiple root elements in the past. We consider it more important to align with the specs that we want to be aligned with, considering the potential security issues that might derive from people not being aware of the difference in behavior.
• Related Spec: https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity

from hyperview.

We could potentially upgrade to 0.7.7 as recommended, to avoid expanding the test surface area in the 0.8 an 0.9 releases.

from hyperview.