Fast XML Parser version 4.0.12 represents a minor update to the popular JavaScript library, building upon the solid foundation of version 4.0.11. Both versions share the same core functionality: validating, parsing, and building XML documents efficiently without relying on C/C++ based libraries, making them ideal for diverse environments. They also maintain identical dependency structures, including "strnum" for string to number conversions, and a suite of development dependencies encompassing tools for testing (jasmine, cytorus, nyc), linting (eslint), bundling (webpack, webpack-cli, babel-loader), code formatting (prettier), and publishing (publish-please).
The key difference lies in the release date and unpacked size. Version 4.0.12 was released on November 19, 2022, subsequent to the October 5, 2022 release of version 4.0.11. A slight increase in the unpacked size of 4.0.12 (98596 bytes) compared to 4.0.11 (98422 bytes) suggests that the newer version incorporates minor bug fixes, performance enhancements, or internal code adjustments.
For developers, this means version 4.0.12 likely offers a more polished and stable XML processing experience. While the core API remains consistent, users can expect potentially improved reliability. Upgrading from 4.0.11 is recommended for those seeking the most current iteration, ensuring they benefit from any accrued improvements the maintainers incorporated in the newer version. Both versions provide a lightweight, dependency-conscious solution for XML handling in JavaScript projects, as reflected in the consistent file count of 20.
All the vulnerabilities related to the version 4.0.12 of the package
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.
const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");
let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"
const parser = new XMLParser();
let jObj = parser.parse(XMLdata);
console.log(jObj.polluted) // should return hacked
The problem has been patched in v4.1.2
User can check for "proto" in the XML string before parsing it to the parser.
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7