Snyk vulnerability from xmldom

[shresthasamir4119]

xmldom XML External Entity (XXE) Injection
Introduced through: [email protected]
Fixed in: [email protected]

Introduced through: [email protected] › [email protected]

Overview
xmldom is an A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. Does not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.

[dbauszus-glx]

This cannot be fixed by simply upgrading the dependency to 0.5.0.

Snyk has also identified issues in xmldom 0.6.0

The maintainer of xmldom is no longer able to publish to npm as xmldom but @xmldom/xmldom

The latest version of @xmldom/xmldom has no reported vulnerabilities but it is not possible to manually install this dependency prior to installing saml2-js. The dependency should be changed to @xmldom/xmldom for which the current version is 0.8.0.

There is already a pull request for this which needs to be released
#245

[mcab]

Addressed in #261.