Raise fast-xml-parser entity expansion limit for large JUnit reports - #3
Conversation
fast-xml-parser's default entity-expansion protection caps total XML entity expansions at 1000, which some real JUnit reports with long failure messages exceed, causing "Entity expansion limit exceeded" parse failures. Configure processEntities.maxTotalExpansions to a much higher bound.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe XML parser now permits up to 100,000 entity expansions. A regression test confirms that a JUnit report with 1,200 entities parses successfully and produces one failed test case. Workspace build permissions were added for ChangesEntity Expansion Parsing
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Without this, pnpm install skips their postinstall scripts (needed to fetch the native binaries) and prints an ERR_PNPM_IGNORED_BUILDS warning.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/main.test.ts (1)
51-63: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd an upper-bound regression case.
This test proves that input above the old default is accepted. It does not prove that
maxTotalExpansions: 100_000still rejects larger input. Add a case with more than 100,000&references and assert thatparseJunitXmlrejects it.Suggested boundary test
+test("parseJunitXml: enforces the entity expansion limit", () => { + const entities = "&".repeat(100_001); + const xml = `<testsuite><testcase><failure>${entities}</failure></testcase></testsuite>`; + assert.throws(() => parseJunitXml(xml)); +});🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main.test.ts` around lines 51 - 63, Add a regression test alongside the existing parseJunitXml entity test using more than 100,000 “&” references, and assert that parseJunitXml rejects the input. Keep the current successful 1,200-entity case unchanged and target the parser’s maxTotalExpansions boundary.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main.ts`:
- Around line 51-55: Upgrade the fast-xml-parser dependency to version 5.5.6 or
later in package.json, regenerate pnpm-lock.yaml, and rebuild dist/index.js so
the configured maxTotalExpansions limit also applies to numeric character
references and standard XML entities.
---
Nitpick comments:
In `@src/main.test.ts`:
- Around line 51-63: Add a regression test alongside the existing parseJunitXml
entity test using more than 100,000 “&” references, and assert that
parseJunitXml rejects the input. Keep the current successful 1,200-entity case
unchanged and target the parser’s maxTotalExpansions boundary.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f1d021b2-5484-4082-bc88-b800a0869b9a
⛔ Files ignored due to path filters (1)
dist/index.jsis excluded by!**/dist/**
📒 Files selected for processing (2)
src/main.test.tssrc/main.ts
| // JUnit reports with long failure messages can legitimately contain more | ||
| // than fast-xml-parser's default 1000-entity expansion cap. | ||
| processEntities: { | ||
| maxTotalExpansions: 100_000, | ||
| }, |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n --glob 'package.json' --glob 'package-lock.json' \
--glob 'npm-shrinkwrap.json' --glob 'yarn.lock' \
--glob 'pnpm-lock.yaml' 'fast-xml-parser' . || true
npm ls fast-xml-parser --all || trueRepository: flipdishbytes/github-actions-junit-summary
Length of output: 757
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- package.json ---'
sed -n '1,80p' package.json
printf '%s\n' '--- lockfile references ---'
sed -n '1,35p' pnpm-lock.yaml
sed -n '435,460p' pnpm-lock.yaml
sed -n '815,840p' pnpm-lock.yaml
printf '%s\n' '--- source context ---'
sed -n '35,70p' src/main.ts
printf '%s\n' '--- repository references ---'
rg -n 'fast-xml-parser|maxTotalExpansions|processEntities' --glob '!pnpm-lock.yaml' .Repository: flipdishbytes/github-actions-junit-summary
Length of output: 9587
🌐 Web query:
fast-xml-parser 4.5.6 maxTotalExpansions processEntities GHSA-8gc5-j5rx-235r patched version
💡 Result:
The security vulnerability GHSA-8gc5-j5rx-235r, tracked as CVE-2026-33036, involves a bypass of entity expansion limits (such as maxTotalExpansions and maxExpandedLength) in the fast-xml-parser library [1][2]. This vulnerability allows numeric character references (e.g., &#NNN;, &#xHH;) and standard XML entities to evade security limits that were intended to prevent Denial of Service (DoS) attacks [1][3]. The affected versions are >= 4.0.0-beta.3 and <= 5.5.5 [4][1]. The vulnerability has been addressed and patched in version 5.5.6 [1][5]. Users are advised to update their fast-xml-parser package to version 5.5.6 or later to mitigate this issue [5].
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2026-33036
- 2: GHSA-8gc5-j5rx-235r
- 3: https://notcve.org/cve/CVE-2026-33036
- 4: GHSA-8gc5-j5rx-235r
- 5: https://www.tenable.com/plugins/cloud-security/438905
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- bundled option normalisation ---'
sed -n '26015,26048p' dist/index.js
printf '%s\n' '--- bundled expansion-limit checks ---'
sed -n '26882,26942p' dist/index.js
printf '%s\n' '--- official advisory ---'
curl -fsSL \
https://api.github.com/repos/NaturalIntelligence/fast-xml-parser/security-advisories/GHSA-8gc5-j5rx-235r \
| jq '{ghsa_id, cve_id, summary, severity, vulnerable_versions, patched_versions}'
printf '%s\n' '--- v5.5.6 package metadata ---'
curl -fsSL https://registry.npmjs.org/fast-xml-parser/5.5.6 \
| jq '{version, engines, dist: {tarball, shasum}}'Repository: flipdishbytes/github-actions-junit-summary
Length of output: 4249
🌐 Web query:
site:github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r fast-xml-parser 5.5.6
💡 Result:
Fast-xml-parser version 5.5.6 is a patched release designed to address vulnerabilities related to XML entity expansion, specifically CVE-2026-26278 [1]. While a prior fix introduced entity expansion limits (such as maxTotalExpansions and maxEntityCount) for DOCTYPE-defined entities, it was discovered that numeric character references and standard XML entities bypassed these security controls [1]. Version 5.5.6 was issued to address this incomplete fix by extending the enforcement of entity expansion limits to these additional code paths [1]. Users are advised to ensure they are using this version or later to mitigate potential denial-of-service risks associated with XML entity expansion [1].
Citations:
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- npm registry 5.5.6 metadata ---'
curl -fsSL https://registry.npmjs.org/fast-xml-parser/5.5.6 \
| jq '{version, engines, dist: {tarball, shasum}}' || true
printf '%s\n' '--- advisory page metadata ---'
curl -LfsS -A 'Mozilla/5.0' \
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r \
| rg -o 'CVE-[0-9]{4}-[0-9]+|5\.5\.[0-9]+|severity[^<]{0,80}|vulnerable[^<]{0,120}|patched[^<]{0,120}' \
| head -40 || true
printf '%s\n' '--- v5.5.6 source references ---'
for path in src/xmlparser/OptionsBuilder.js src/xmlparser/OrderedObjParser.js; do
printf '%s\n' "--- ${path} ---"
curl -LfsS https://raw.githubusercontent.com/NaturalIntelligence/fast-xml-parser/v5.5.6/${path} \
| rg -n 'maxTotalExpansions|maxExpandedLength|maxEntityCount|processEntities|charRef|numeric|entity' \
| head -80 || true
doneRepository: flipdishbytes/github-actions-junit-summary
Length of output: 3946
🌐 Web query:
"GHSA-8gc5-j5rx-235r" "5.5.6" severity fast-xml-parser
💡 Result:
The security advisory GHSA-8gc5-j5rx-235r, also identified as CVE-2026-33036, is a high-severity vulnerability (CVSS score 7.5) affecting the fast-xml-parser library [1][2][3]. The vulnerability involves a bypass of XML entity expansion limits. While a previous fix (for CVE-2026-26278) introduced limits to prevent Denial of Service (DoS) attacks via XML entity expansion, these protections only applied to DOCTYPE-defined entities [4][5][3]. The vulnerability exists because numeric character references (such as &#NNN; and &#xHH;) and standard XML entities are processed via a separate code path in the replaceEntitiesValue function that lacks these expansion limits [4][5]. An attacker can exploit this by providing specially crafted XML containing a large volume of these entity references, causing excessive memory allocation and CPU consumption, which can lead to a process crash even if developers have configured strict security limits [5][3]. The issue was addressed and fixed in fast-xml-parser version 5.5.6 [5][3]. Users of affected versions (4.0.0-beta.3 through 5.5.5) are advised to upgrade to 5.5.6 to mitigate the risk [6][5][3].
Citations:
- 1: GHSA-8gc5-j5rx-235r
- 2: GHSA-8gc5-j5rx-235r
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-33036
- 4: GHSA-8gc5-j5rx-235r
- 5: https://nvd.nist.gov/vuln/detail/cve-2026-33036
- 6: https://test.osv.dev/vulnerability/GHSA-8gc5-j5rx-235r
Upgrade fast-xml-parser to 5.5.6 or later.
Version 4.5.6 enforces maxTotalExpansions for declared entities, but numeric character references and standard XML entities can bypass this limit. Update package.json and pnpm-lock.yaml, then rebuild dist/index.js.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/main.ts` around lines 51 - 55, Upgrade the fast-xml-parser dependency to
version 5.5.6 or later in package.json, regenerate pnpm-lock.yaml, and rebuild
dist/index.js so the configured maxTotalExpansions limit also applies to numeric
character references and standard XML entities.
Source: MCP tools
2 participants
Summary
fast-xml-parserv4.5+ ships a security limit that caps total XML entity expansions (e.g.&,<) per document at 1000. JUnit reports with long failure messages/stack traces can legitimately exceed that, which was causingFailed to parse ...xml: Entity expansion limit exceeded: 1001 > 1000in this action.processEntities.maxTotalExpansions: 100000on theXMLParserinstance insrc/main.tsso legitimate reports parse successfully, while still keeping the entity-expansion protection enabled (just with a higher, safe ceiling).dist/index.jsviapnpm buildsince this is a compiled action.Test plan
src/main.test.ts) that parses a JUnit XML fixture containing 1200&entities and asserts it parses successfully (previously this would throw).pnpm check(format check, typecheck, full test suite, build) passes locally.Generated by Claude Code
Summary by CodeRabbit
Bug Fixes
Tests