allow to use libxml2-wasm for XML validation
#1184
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| /*! | ||
| This file is part of CycloneDX JavaScript Library. | ||
|
|
||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
|
|
||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
|
|
||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
|
|
||
| SPDX-License-Identifier: Apache-2.0 | ||
| Copyright (c) OWASP Foundation. All Rights Reserved. | ||
| */ | ||
|
|
||
| import { readFile } from 'fs/promises'; | ||
| import { ParseOption, XmlDocument, XsdValidator } from 'libxml2-wasm'; | ||
| import { pathToFileURL } from 'url'; | ||
|
|
||
| import type { ValidationError } from '../../validation/types'; | ||
| import type { Functionality, Validator } from '../xmlValidator'; | ||
|
|
||
| /** @internal */ | ||
| export default (async function (schemaPath: string): Promise<Validator> { | ||
| const schema = XmlDocument.fromString( | ||
| await readFile(schemaPath, 'utf-8'), | ||
| { | ||
| option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT, | ||
|
There was a problem hiding this comment. is this XEE safe? see https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing There was a problem hiding this comment. The interface for this wrapper is somewhat different, building the parse options is combining the flags you want on. In the other implementation it's an object where they could be turned on and off explicitely. So this should result in the same options. I also added this implementation to the xmlValidator tests, and that includes an XXE test. There was a problem hiding this comment. lets see how the tests turn out. |
||
| url: pathToFileURL(schemaPath).toString() | ||
| }); | ||
| const validator = XsdValidator.fromDoc(schema); | ||
|
|
||
| return function (data: string): null | ValidationError { | ||
| const doc = XmlDocument.fromString(data, { option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT }); | ||
|
There was a problem hiding this comment. the options should be a constant, that is created outside the function. |
||
| let errors = null; | ||
| try { | ||
| validator.validate(doc); | ||
| } | ||
| catch (validationErrors) { | ||
| errors = validationErrors; | ||
| } | ||
|
|
||
| doc.dispose(); | ||
| validator.dispose(); | ||
|
There was a problem hiding this comment. really free/dispose the validator and schema here? There was a problem hiding this comment. Good point, this will go wrong the second call. I could just not dispose the validator and the schema. But the library emphasises proper disposing (https://jameslan.github.io/libxml2-wasm/v0.4/documents/Memory_Management.html). Here I'm really lacking in Typescript knowledge on how to solve this, could I use a There was a problem hiding this comment. regarding regarding manually disposing/freeing: maybe just try it out. in the end, it all is javascript - just see what you can do. |
||
| schema.dispose(); | ||
|
|
||
| return errors; | ||
| } | ||
| }) satisfies Functionality | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please bring this line back