xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

• >= 0.7.0, <= 0.8.14

## Summary xmldom's parser silently accepts a **not-well-formed end tag** whose valid name is followed by trailing content — e.g. ``. The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name and both Chromium and Firefox reject such input as `application/xml`. An application that relies on xmldom to reject not-well-formed input therefore receives a false "valid" result for a document the specification and browsers consider malformed. ## Details Across every affected version, an end tag whose valid `Name` is followed by trailing content before `>` is silently accepted: the element is closed, the residue is dropped, and no error is reported. How much leaks differs by line (see Affected Versions), but the observable weakness is the same. On the current (`0.9.x`) line, the parser validates the end-tag name against the XML `ETag` production with an anchored regular expression (`^ QName S? $`). That expression is compiled with the `m` (multiline) flag by a shared builder, so `$` matches at an interior line terminator: a valid name on the first line satisfies the a

GitHub Advisory Database

• >= 0.9.0, <= 0.9.11

## Summary xmldom's parser silently accepts a **not-well-formed end tag** whose valid name is followed by trailing content — e.g. ``. The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name and both Chromium and Firefox reject such input as `application/xml`. An application that relies on xmldom to reject not-well-formed input therefore receives a false "valid" result for a document the specification and browsers consider malformed. ## Details Across every affected version, an end tag whose valid `Name` is followed by trailing content before `>` is silently accepted: the element is closed, the residue is dropped, and no error is reported. How much leaks differs by line (see Affected Versions), but the observable weakness is the same. On the current (`0.9.x`) line, the parser validates the end-tag name against the XML `ETag` production with an anchored regular expression (`^ QName S? $`). That expression is compiled with the `m` (multiline) flag by a shared builder, so `$` matches at an interior line terminator: a valid name on the first line satisfies the a

GitHub Advisory Database

• <= 0.6.0

## Summary xmldom's parser silently accepts a **not-well-formed end tag** whose valid name is followed by trailing content — e.g. ``. The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name and both Chromium and Firefox reject such input as `application/xml`. An application that relies on xmldom to reject not-well-formed input therefore receives a false "valid" result for a document the specification and browsers consider malformed. ## Details Across every affected version, an end tag whose valid `Name` is followed by trailing content before `>` is silently accepted: the element is closed, the residue is dropped, and no error is reported. How much leaks differs by line (see Affected Versions), but the observable weakness is the same. On the current (`0.9.x`) line, the parser validates the end-tag name against the XML `ETag` production with an anchored regular expression (`^ QName S? $`). That expression is compiled with the `m` (multiline) flag by a shared builder, so `$` matches at an interior line terminator: a valid name on the first line satisfies the a

GitHub Advisory Database