Skip to content

Raise fast-xml-parser entity expansion limit for large JUnit reports #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fdmarc merged 2 commits into from
Aug 8, 2026
Merged

Raise fast-xml-parser entity expansion limit for large JUnit reports #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
187d3cf
Raise fast-xml-parser entity expansion limit for large JUnit reports
claude Aug 8, 2026
8157eb6
Add pnpm-workspace.yaml to allow esbuild/biome install scripts
claude Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27655,7 +27655,12 @@ var parser = new import_fast_xml_parser.XMLParser({
textNodeName: "#text",
parseAttributeValue: false,
trimValues: true,
isArray: (name) => ["testsuite", "testcase", "failure", "error", "skipped"].includes(name)
isArray: (name) => ["testsuite", "testcase", "failure", "error", "skipped"].includes(name),
// JUnit reports with long failure messages can legitimately contain more
// than fast-xml-parser's default 1000-entity expansion cap.
processEntities: {
maxTotalExpansions: 1e5
}
});
function parseJunitXml(xml) {
const doc = parser.parse(xml);
Expand Down
3 changes: 3 additions & 0 deletions pnpm-workspace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
allowBuilds:
'@biomejs/biome': true
esbuild: true
13 changes: 13 additions & 0 deletions src/main.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,19 @@ test("parseJunitXml: handles nested <testsuites>", () => {
assert.equal(cases[0]!.classname, "inner.SuiteA");
});

test("parseJunitXml: handles reports with more than 1000 XML entities", () => {
const entities = "&amp;".repeat(1200);
const xml = `<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="Suite" tests="1">
<testcase classname="Suite" name="test with many entities" time="0.001">
<failure message="Expected ${entities}">at ${entities}</failure>
</testcase>
</testsuite>`;
const cases = parseJunitXml(xml);
assert.equal(cases.length, 1);
assert.equal(cases[0]!.status, "failed");
});

test("extractLocation: finds file/line in a node-style stack", () => {
const loc = extractLocation(
"AssertionError: boom\n at Object.<anonymous> (src/util.ts:42:7)\n at Module._compile",
Expand Down
5 changes: 5 additions & 0 deletions src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,11 @@ const parser = new XMLParser({
trimValues: true,
isArray: (name) =>
["testsuite", "testcase", "failure", "error", "skipped"].includes(name),
// JUnit reports with long failure messages can legitimately contain more
// than fast-xml-parser's default 1000-entity expansion cap.
processEntities: {
maxTotalExpansions: 100_000,
},
Comment on lines +51 to +55

@coderabbitai coderabbitai Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n --glob 'package.json' --glob 'package-lock.json' \
  --glob 'npm-shrinkwrap.json' --glob 'yarn.lock' \
  --glob 'pnpm-lock.yaml' 'fast-xml-parser' . || true

npm ls fast-xml-parser --all || true

Repository: flipdishbytes/github-actions-junit-summary

Length of output: 757

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- package.json ---'
sed -n '1,80p' package.json

printf '%s\n' '--- lockfile references ---'
sed -n '1,35p' pnpm-lock.yaml
sed -n '435,460p' pnpm-lock.yaml
sed -n '815,840p' pnpm-lock.yaml

printf '%s\n' '--- source context ---'
sed -n '35,70p' src/main.ts

printf '%s\n' '--- repository references ---'
rg -n 'fast-xml-parser|maxTotalExpansions|processEntities' --glob '!pnpm-lock.yaml' .

Repository: flipdishbytes/github-actions-junit-summary

Length of output: 9587

🌐 Web query:

fast-xml-parser 4.5.6 maxTotalExpansions processEntities GHSA-8gc5-j5rx-235r patched version

💡 Result:

The security vulnerability GHSA-8gc5-j5rx-235r, tracked as CVE-2026-33036, involves a bypass of entity expansion limits (such as maxTotalExpansions and maxExpandedLength) in the fast-xml-parser library [1][2]. This vulnerability allows numeric character references (e.g., &#NNN;, &#xHH;) and standard XML entities to evade security limits that were intended to prevent Denial of Service (DoS) attacks [1][3]. The affected versions are >= 4.0.0-beta.3 and <= 5.5.5 [4][1]. The vulnerability has been addressed and patched in version 5.5.6 [1][5]. Users are advised to update their fast-xml-parser package to version 5.5.6 or later to mitigate this issue [5].

Citations:

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- bundled option normalisation ---'
sed -n '26015,26048p' dist/index.js

printf '%s\n' '--- bundled expansion-limit checks ---'
sed -n '26882,26942p' dist/index.js

printf '%s\n' '--- official advisory ---'
curl -fsSL \
  https://api.github.com/repos/NaturalIntelligence/fast-xml-parser/security-advisories/GHSA-8gc5-j5rx-235r \
  | jq '{ghsa_id, cve_id, summary, severity, vulnerable_versions, patched_versions}'

printf '%s\n' '--- v5.5.6 package metadata ---'
curl -fsSL https://registry.npmjs.org/fast-xml-parser/5.5.6 \
  | jq '{version, engines, dist: {tarball, shasum}}'

Repository: flipdishbytes/github-actions-junit-summary

Length of output: 4249

🌐 Web query:

site:github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r fast-xml-parser 5.5.6

💡 Result:

Fast-xml-parser version 5.5.6 is a patched release designed to address vulnerabilities related to XML entity expansion, specifically CVE-2026-26278 [1]. While a prior fix introduced entity expansion limits (such as maxTotalExpansions and maxEntityCount) for DOCTYPE-defined entities, it was discovered that numeric character references and standard XML entities bypassed these security controls [1]. Version 5.5.6 was issued to address this incomplete fix by extending the enforcement of entity expansion limits to these additional code paths [1]. Users are advised to ensure they are using this version or later to mitigate potential denial-of-service risks associated with XML entity expansion [1].

Citations:

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- npm registry 5.5.6 metadata ---'
curl -fsSL https://registry.npmjs.org/fast-xml-parser/5.5.6 \
  | jq '{version, engines, dist: {tarball, shasum}}' || true

printf '%s\n' '--- advisory page metadata ---'
curl -LfsS -A 'Mozilla/5.0' \
  https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r \
  | rg -o 'CVE-[0-9]{4}-[0-9]+|5\.5\.[0-9]+|severity[^<]{0,80}|vulnerable[^<]{0,120}|patched[^<]{0,120}' \
  | head -40 || true

printf '%s\n' '--- v5.5.6 source references ---'
for path in src/xmlparser/OptionsBuilder.js src/xmlparser/OrderedObjParser.js; do
  printf '%s\n' "--- ${path} ---"
  curl -LfsS https://raw.githubusercontent.com/NaturalIntelligence/fast-xml-parser/v5.5.6/${path} \
    | rg -n 'maxTotalExpansions|maxExpandedLength|maxEntityCount|processEntities|charRef|numeric|entity' \
    | head -80 || true
done

Repository: flipdishbytes/github-actions-junit-summary

Length of output: 3946

🌐 Web query:

"GHSA-8gc5-j5rx-235r" "5.5.6" severity fast-xml-parser

💡 Result:

The security advisory GHSA-8gc5-j5rx-235r, also identified as CVE-2026-33036, is a high-severity vulnerability (CVSS score 7.5) affecting the fast-xml-parser library [1][2][3]. The vulnerability involves a bypass of XML entity expansion limits. While a previous fix (for CVE-2026-26278) introduced limits to prevent Denial of Service (DoS) attacks via XML entity expansion, these protections only applied to DOCTYPE-defined entities [4][5][3]. The vulnerability exists because numeric character references (such as &#NNN; and &#xHH;) and standard XML entities are processed via a separate code path in the replaceEntitiesValue function that lacks these expansion limits [4][5]. An attacker can exploit this by providing specially crafted XML containing a large volume of these entity references, causing excessive memory allocation and CPU consumption, which can lead to a process crash even if developers have configured strict security limits [5][3]. The issue was addressed and fixed in fast-xml-parser version 5.5.6 [5][3]. Users of affected versions (4.0.0-beta.3 through 5.5.5) are advised to upgrade to 5.5.6 to mitigate the risk [6][5][3].

Citations:

Upgrade fast-xml-parser to 5.5.6 or later.

Version 4.5.6 enforces maxTotalExpansions for declared entities, but numeric character references and standard XML entities can bypass this limit. Update package.json and pnpm-lock.yaml, then rebuild dist/index.js.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/main.ts` around lines 51 - 55, Upgrade the fast-xml-parser dependency to
version 5.5.6 or later in package.json, regenerate pnpm-lock.yaml, and rebuild
dist/index.js so the configured maxTotalExpansions limit also applies to numeric
character references and standard XML entities.

Source: MCP tools

});

export function parseJunitXml(xml: string): TestCase[] {
Expand Down
Loading