Summary
An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name
validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should
reject a malformed qualified name with InvalidCharacterError, but a name whose first line is
well-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the
characters after the line terminator inject markup into the output. The injection reaches the default
serialization path, and enabling requireWellFormed does not prevent it.
Details
createElementNS, createAttributeNS, and createDocumentType route through validateQualifiedName,
and createAttribute performs the analogous check; each validates the name with
g.QName_exact.test(name). QName_exact = reg('^', QName, '$') inherits the m flag from xmldom's
shared regexp builder, so the matcher accepts any name whose first line is a valid QName and leaves
the remaining lines unconstrained (see Root Cause).
Root Cause
- A shared regexp builder compiles anchored productions with the
m flag.
^…$ under m are line anchors, not string anchors.validateQualifiedName / createAttribute validate with .test() against such a production, so a
line terminator followed by breakout markup passes and the malformed name is stored.
The triggering line terminators are the ECMAScript LineTerminator set: U+000A, U+000D, U+2028, U+2029.
Proof of Concept
const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
const impl = new DOMImplementation();
const doc = impl.createDocument('urn:x', 'root', null);
const el = doc.createElementNS('urn:x', 'a\n><script>x</script'); // ACCEPTED (no throw)
doc.documentElement.appendChild(el);
// DEFAULT serialization — requireWellFormed NOT set:
console.log(new XMLSerializer().serializeToString(doc));
// Observed: <root xmlns="urn:x"><a
// ><script>x</script/></root> <-- injected element on the default path
// Control: createElementNS('urn:x', 'bad>name') throws InvalidCharacterError, confirming the check is
// active and specifically bypassed by the line terminator.Impact
- Bypass of the always-on WHATWG creation-time name validation (
InvalidCharacterError): a
malformed name the standard requires be rejected at creation is instead admitted to the DOM.
- Markup / structure injection. An application relying on the
create* APIs to reject malformed
names (the standard behavior) as a trust boundary is exposed; where the serialized output reaches an
HTML context, downstream XSS.
- No serializer option mitigates it. The admitted name is emitted verbatim under both the default
path and requireWellFormed: true — the strict serializer shares the same m-flagged blind spot
(the subject of the sibling serializer advisories) — so the bypassed creation-time check was the only
layer that could have stopped it. Demonstrated for all four create* sites in
poc_creation_strict_serialization_bypass.cjs.
Fix Applied
createElementNS, createAttributeNS, createDocumentType, and createAttribute now reject a name
containing a line terminator with InvalidCharacterError — the same result they already give for
other malformed names — because name validation now applies to the whole string. The
requireWellFormed serializer's name checks are corrected by the same change. The fix is
non-breaking: such a name was already invalid, and no previously-accepted well-formed name is affected.
References
karfau Finder
Summary
An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name
validation.
createElementNS,createAttributeNS,createDocumentType, andcreateAttributeshouldreject a malformed qualified name with
InvalidCharacterError, but a name whose first line iswell-formed slips through and enters the DOM. On serialization it is emitted verbatim, so the
characters after the line terminator inject markup into the output. The injection reaches the default
serialization path, and enabling
requireWellFormeddoes not prevent it.Details
createElementNS,createAttributeNS, andcreateDocumentTyperoute throughvalidateQualifiedName,and
createAttributeperforms the analogous check; each validates the name withg.QName_exact.test(name).QName_exact = reg('^', QName, '$')inherits themflag from xmldom'sshared regexp builder, so the matcher accepts any name whose first line is a valid
QNameand leavesthe remaining lines unconstrained (see Root Cause).
Root Cause
mflag.^…$undermare line anchors, not string anchors.validateQualifiedName/createAttributevalidate with.test()against such a production, so aline terminator followed by breakout markup passes and the malformed name is stored.
The triggering line terminators are the ECMAScript
LineTerminatorset: U+000A, U+000D, U+2028, U+2029.Proof of Concept
Impact
InvalidCharacterError): amalformed name the standard requires be rejected at creation is instead admitted to the DOM.
create*APIs to reject malformednames (the standard behavior) as a trust boundary is exposed; where the serialized output reaches an
HTML context, downstream XSS.
path and
requireWellFormed: true— the strict serializer shares the samem-flagged blind spot(the subject of the sibling serializer advisories) — so the bypassed creation-time check was the only
layer that could have stopped it. Demonstrated for all four
create*sites inpoc_creation_strict_serialization_bypass.cjs.Fix Applied
createElementNS,createAttributeNS,createDocumentType, andcreateAttributenow reject a namecontaining a line terminator with
InvalidCharacterError— the same result they already give forother malformed names — because name validation now applies to the whole string. The
requireWellFormedserializer's name checks are corrected by the same change. The fix isnon-breaking: such a name was already invalid, and no previously-accepted well-formed name is affected.
References