fix: prevent colons in pi and entity names when xmlns is true

lddubeau · Jul 4, 2018 · 4327eec · 4327eec
1 parent 2433fdc
commit 4327eec
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/lib/saxes.js b/lib/saxes.js
@@ -518,6 +518,16 @@ class SAXParser {
           this.state = S_PROC_INST_BODY;
         }
         else {
+          // When namespaces are used, colons are not valid in pi names.
+          // https://www.w3.org/XML/xml-names-19990114-errata.html
+          // NE08
+          if (!(isMatch(this.procInstName.length ? nameBody : nameStart, c) &&
+                 // When namespaces are used, colons are not valid in entity names.
+                 // https://www.w3.org/XML/xml-names-19990114-errata.html
+                 // NE08
+                (!this.opt.xmlns || c !== ":"))) {
+            this.fail("Invalid characer in processing instruction name.");
+          }
           this.procInstName += c;
         }
         continue;
@@ -790,7 +800,11 @@ class SAXParser {
           this.entity = "";
           this.state = returnState;
         }
-        else if (isMatch(this.entity.length ? entityBody : entityStart, c)) {
+        else if (isMatch(this.entity.length ? entityBody : entityStart, c) &&
+                 // When namespaces are used, colons are not valid in entity names.
+                 // https://www.w3.org/XML/xml-names-19990114-errata.html
+                 // NE08
+                 (!this.opt.xmlns || c !== ":")) {
           this.entity += c;
         }
         else {