Switch to libxml2-wasm for XML validation

Due to libxmljs2 not being maintained and contains a vulnerability, a replacement needed to be found.
This commit replaces it with libxml2-wasm, which is a new, but maintained library, which serves the purpose of validating XML.

The implementation is as close the the previous library in regards to flags passed to libxml2, but only adapted to a different interface and the recommendation to dispose all objects.

This is my first contribution to this project, and typescript isn't my usual language, so comments are welcome.

Resolves: CycloneDX#1079

Author: LeonGrave

docs/dev/decisions/XmlValidator.md

@@ -22,7 +22,8 @@ There are several implementations for this:
 * [`libxmljs3`](https://www.npmjs.com/package/libxmljs3)
   * unmaintained copy of `libxmljs2`
   * ! DO NOT USE !
-* Any alternative? Please open a pull-request to add them.
+* [`libxml2-wasm`](https://www.npmjs.com/package/libxml2-wasm)
+  * maintained WASM implementation of a libxml2 wrapper
 
 At the moment of writing (2023-04-21),
 `libxmljs` and `libxmljs2` are both working on several test environments. Both had the needed capabilities.
@@ -38,6 +39,10 @@ as it was more popular/used and had a more active community.
 
 Decided to replace `libxmljs2`, as it is end of life.
 
+#### 2024-11-26
+
+Decided to replace `libxmljs2` with `libxml2-wasm`, since it's maintained and a functioning XML validator.
+
 ## WebBrowsers
 
 there seams to exist no solution for validating XML according to XSD

package.json

@@ -87,7 +87,7 @@
     "ajv": "^8.12.0",
     "ajv-formats": "^3.0.1",
     "ajv-formats-draft2019": "^1.6.1",
-    "libxmljs2": "^0.31 || ^0.32 || ^0.33 || ^0.35",
+    "libxml2-wasm": "^0.4.1",
     "xmlbuilder2": "^3.0.2"
   },
   "devDependencies": {

src/_optPlug.node/__xmlValidators/libxmljs2.ts src/_optPlug.node/__xmlValidators/libxml2-wasm.ts

@@ -18,31 +18,36 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
 import { readFile } from 'fs/promises'
-import { type ParserOptions, parseXml } from 'libxmljs2'
 import { pathToFileURL } from 'url'
+import { ParseOption, XmlDocument, XsdValidator } from 'libxml2-wasm';
 
 import type { ValidationError } from '../../validation/types'
 import type { Functionality, Validator } from '../xmlValidator'
 
-const xmlParseOptions: Readonly<ParserOptions> = Object.freeze({
-  nonet: true,
-  compact: true,
-  // explicitly prevent XXE
-  // see https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
-  // see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
-  noent: false,
-  dtdload: false
-})
-
 /** @internal */
 export default (async function (schemaPath: string): Promise<Validator> {
-  const schema = parseXml(await readFile(schemaPath, 'utf-8'),
-    { ...xmlParseOptions, baseUrl: pathToFileURL(schemaPath).toString() })
+  const schema = XmlDocument.fromString(
+    await readFile(schemaPath, 'utf-8'),
+    {
+      option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT,
+      url: pathToFileURL(schemaPath).toString()
+    });
+  const validator = XsdValidator.fromDoc(schema);
 
   return function (data: string): null | ValidationError {
-    const doc = parseXml(data, xmlParseOptions)
-    return doc.validate(schema)
-      ? null
-      : doc.validationErrors
+    const doc = XmlDocument.fromString(data, { option: ParseOption.XML_PARSE_NONET | ParseOption.XML_PARSE_COMPACT });
+    var errors;
+    try {
+      validator.validate(doc);
+    }
+    catch(validationErrors) {
+      errors = validationErrors;
+    }
+
+    doc.dispose();
+    validator.dispose();
+    schema.dispose();
+
+    return errors != null ? errors : null;
   }
 }) satisfies Functionality

src/_optPlug.node/xmlValidator.ts

@@ -27,7 +27,7 @@ export default opWrapper<Functionality>('XmlValidator', [
   /* eslint-disable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports
      -- needed */
 
-  ['libxmljs2', () => require('./__xmlValidators/libxmljs2').default]
+  ['libxml2-wasm', () => require('./__xmlValidators/libxml2-wasm').default]
   // ... add others here, pull-requests welcome!
 
   /* eslint-enable @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-require-imports */