Vulnerability: Misinterpretation of malicious XML input

[leifjones]

Per this advisory, it seems that it's recommended that a version of xmldom >= 0.5.0 is used instead.

I came upon this when running npm install for a project that currently utilizes JUnitXMLReporter of this package.

[arobinson]

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Misinterpretation of malicious XML input                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ xmldom                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.7.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jasmine-reporters [dev]                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jasmine-reporters > xmldom                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1769                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[fennibay]

xmldom could not be updated due to missing permissions. The proposed solution is to switch to the @xmldom/xmldom Refs: xmldom/xmldom#278 xmldom/xmldom#271

[rvravi]

@putermancer Could you please take a look in to this?

[larrymyers]

Resolved in recently merged PR.

[rvravi]

@larrymyers Could you please publish a version with this fix?

[fennibay]

Resolved in recently merged PR.

Do you mean #205? I believe this fix is not correct, xmldom does not have a version 0.7.0. It was moved to @xmldom/xmldom, where the latest version is 0.7.3 currently. I had sent some links in my comment above about the background of this move.

I created new PR #206 to fix the issue.

Shall we re-open this issue until new jasmine-reporters version is published?