NaturalIntelligence / fast-xml-parser

Validate XML, Parse XML and Build XML rapidly without C/C++ based libraries and no callback.
https://naturalintelligence.github.io/fast-xml-parser/
MIT License
2.43k stars 297 forks source link

Properties from Object's prototype are including during XML creation #610

Closed aparshin closed 9 months ago

aparshin commented 10 months ago

Description

If a custom property is added to Object's prototype, it is included in generated XML. It shouldn't happen because in some cases users can't control pollution of Object / Array prototypes.

Input

{a: 1}

Code

const { XMLBuilder } = require("fast-xml-parser");

// emulate pollution of Object's prototype
Object.prototype.something = 'strange';

const builder = new XMLBuilder();
const xml = builder.build({ a: 1 });

console.log(xml);

Output

<a>1</a><something>strange</something> 

Expected output

<a>1</a>

Would you like to work on this issue?

Bookmark this repository for further updates. Visit SoloThought to know about recent features.

github-actions[bot] commented 10 months ago

We're glad you find this project helpful. We'll try to address this issue ASAP. You can vist https://solothought.com to know recent features. Don't forget to star this repo.

aparshin commented 10 months ago

Maybe https://github.com/NaturalIntelligence/fast-xml-parser/pull/268 is somehow related to this issue...