Throws Error on external entities even with processEntities set to false

[matthieupauze]

• Are you running the latest version?
• Have you included sample input, output, error, and expected output?
• Have you checked if you are using correct configuration?
• Did you try online tool?
• Have you checked the docs for helpful APIs and examples?

Description

When I provide processEntities = false, I expect that entities are not parsed, and therefore errors related to unsupported entity types are ignored.

For now, I've rolled back to v3 before entity support was introduced and it parses the file fine for my use case.

Couple of possibilities:

• The error could be emitted via console.error, instead of throwing and interrupting the parsing. That way we get the output file anyway. I don't know if this spec-compliant behaviour, but it could be more ergonomic.
• Change where the error is emitted. Instead of emitting when parsing it, it could be emitted later within the confines of the replaceEntitiesValue function This means we would parse and then skip emitting the error because we're ignoring them.
• Skip all entities when parsing with option = false. In v3, it appears you simply updated the index to past the element you wanted to skip with minimal validation, for instance with !DOCTYPE. In this case, I think you could check the processEntities flag before your call to readDocType and update the index to the end of the doctype. It doesn't appear that you parse non-entity fields for the time being, so this could be OK, and maybe even speed up the parsing.

If any of these look interesting, please let me know and I'll create a PR for it. I personally think opt. 3 is the most reasonable, but it's your call.

Input

XML

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dmodule [
   <!ENTITY EXTERNAL-IMAGE SYSTEM "EXTERNAL-IMAGE.cgm" NDATA cgm>
   <!NOTATION cgm SYSTEM "cgm">
   <!NOTATION tif SYSTEM "tif">
]>
<element xmlns:xlink="http://www.w3.org/1999/xlink"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
Hello!
</element>

Code

const parser = new XMLParser({
  ignoreAttributes: false,
  attributeNamePrefix: "@",
  processEntities: false,
  stopNodes: ["dmCode"],
});
const fPath = "./test.xml";
const fileContent = fs.readFileSync(fPath, { encoding: "utf8" });
const obj = parser.parse(fileContent);

Output

// node_modules path stripped for anonymity
Error: External entities are not supported
    at readEntityExp (node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js:107:15)
    at readDocType (node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js:23:43)
    at OrderedObjParser.parseXml (node_modules/fast-xml-parser/src/xmlparser/OrderedObjParser.js:265:24)
    at XMLParser.parse (node_modules/fast-xml-parser/src/xmlparser/XMLParser.js:36:48)

expected data

No errors.
An object formed like { element: { "#text": "Hello!" } } or something similar in this case.

Would you like to work on this issue?

• Yes
• No

Bookmark this repository for further updates. Visit SoloThought to know about recent features.

[github-actions]

We're glad you find this project helpful. We'll try to address this issue ASAP. You can vist https://solothought.com to know recent features. Don't forget to star this repo.

[amitguptagwl]

Let me check

[amitguptagwl]

We were previously reading DOCTYPE silently to find its boundary but now we're validating it too which should not happen if the flag is set to false. However, if there is any syntax error then it can't be avoided. But need to be reported as we'll not be able to determine the boundary.

[amitguptagwl]

Considering the changes required, it is difficult to ignore DOCTYPE completely as we can't determine the boundary in case of bad syntax. Hence, we'll have to deprecate the flag.