Installations
npm install xmldom-qsa
Developer Guide
Typescript
Yes
Module System
CommonJS
Min. Node Version
>=8.0.0
Node Version
16.10.0
NPM Version
7.24.0
Score
98.6
Supply Chain
100
Quality
75.9
Maintenance
100
Vulnerability
100
License
Releases
Unable to fetch releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (99.5%)
Handlebars (0.31%)
Shell (0.18%)
Developer
zeligzhou
Download Statistics
Total Downloads
2,468,253
Last Day
4,464
Last Week
20,236
Last Month
107,052
Last Year
966,370
GitHub Statistics
6 Stars
510 Commits
1 Forks
1 Watching
9 Branches
1 Contributors
Bundle Size
47.26 kB
Minified
16.87 kB
Minified + Gzipped
Package Meta Information
Latest Version
1.1.3
Package Id
xmldom-qsa@1.1.3
Unpacked Size
179.40 kB
Size
47.59 kB
File Count
14
NPM Version
7.24.0
Node Version
16.10.0
Publised On
30 Apr 2023
Total Downloads
Cumulative downloads
Total Downloads
2,468,253
Last day
-21.5%
4,464
Compared to previous day
Last week
-35.3%
20,236
Compared to previous week
Last month
18.9%
107,052
Compared to previous month
Last year
50.5%
966,370
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
xmldom-qsa
This is based on xmldom with some minor enhancements.
xmldom-qsa
add querySelector
, querySelectorAll
and match
method to Document
and Element
. And you can write some more methods to these elements by add prototype
methods to Node.
xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes:
- convert an XML string into a DOM tree
new DOMParser().parseFromString(xml, mimeType) => Document
- create, access and modify a DOM tree
new DOMImplementation().createDocument(...) => Document
- serialize a DOM tree back into an XML string
new XMLSerializer().serializeToString(node) => string
The target runtimes xmldom
supports are currently Node >= v10 (ES5) and Rhino (not tested as part of CI).
When deciding how to fix bugs or implement features, xmldom
tries to stay as close as possible to the various related specifications/standards.
As indicated by the version starting with 0.
, this implementation is not feature complete and some implemented features differ from what the specifications describe.
Issues and PRs for such differences are always welcome, even when they only provide a failing test case.
This project was forked from it's original source in 2019, more details about that transition can be found in the CHANGELOG.
Usage
Install:
npm install xmldom-qsa
Enhancements:
1 2doc.documentElement.querySelector('.clazz'); 3 4var Node = require('xmldom-qsa/dom').Node; 5Node.prototype.addAttr = function(x,y) { ... } 6doc.documentElement.addAttr('x','y'); 7
Example:
1const { DOMParser } = require('xmldom-qsa') 2 3const doc = new DOMParser().parseFromString( 4 '<xml xmlns="a" xmlns:c="./lite">\n' + 5 '\t<child>test</child>\n' + 6 '\t<child></child>\n' + 7 '\t<child/>\n' + 8 '</xml>', 9 'text/xml' 10) 11doc.documentElement.setAttribute('x', 'y') 12doc.documentElement.setAttributeNS('./lite', 'c:x', 'y2') 13console.info(doc) 14 15const nsAttr = doc.documentElement.getAttributeNS('./lite', 'x') 16console.info(nsAttr)
Note: in Typescript and ES6(see #316) you can use the import
approach, as follows:
1import { DOMParser } from 'xmldom-qsa'
API Reference
-
1parseFromString(xmlsource,mimeType)
- options extension by xmldom (not DOM standard!!)
1//added the options argument 2new DOMParser(options) 3 4//errorHandler is supported 5new DOMParser({ 6 /** 7 * locator is always need for error position info 8 */ 9 locator:{}, 10 /** 11 * you can override the errorHandler for xml parser 12 * @link http://www.saxproject.org/apidoc/org/xml/sax/ErrorHandler.html 13 */ 14 errorHandler:{warning:function(w){console.warn(w)},error:callback,fatalError:callback} 15 //only callback model 16 //errorHandler:function(level,msg){console.log(level,msg)} 17}) 18
-
1serializeToString(node)
DOM level2 method and attribute:
-
readonly class properties (aka
NodeType
), these can be accessed from anyNode
instancenode
:if (node.nodeType === node.ELEMENT_NODE) {...
ELEMENT_NODE
(1
)ATTRIBUTE_NODE
(2
)TEXT_NODE
(3
)CDATA_SECTION_NODE
(4
)ENTITY_REFERENCE_NODE
(5
)ENTITY_NODE
(6
)PROCESSING_INSTRUCTION_NODE
(7
)COMMENT_NODE
(8
)DOCUMENT_NODE
(9
)DOCUMENT_TYPE_NODE
(10
)DOCUMENT_FRAGMENT_NODE
(11
)NOTATION_NODE
(12
)
attribute:
nodeValue
|prefix
readonly attribute:
nodeName
|nodeType
|parentNode
|childNodes
|firstChild
|lastChild
|previousSibling
|nextSibling
|attributes
|ownerDocument
|namespaceURI
|localName
method:
insertBefore(newChild, refChild)
replaceChild(newChild, oldChild)
removeChild(oldChild)
appendChild(newChild)
hasChildNodes()
cloneNode(deep)
normalize()
isSupported(feature, version)
hasAttributes()
-
extends the Error type thrown as part of DOM API.
readonly class properties:
INDEX_SIZE_ERR
(1
)DOMSTRING_SIZE_ERR
(2
)HIERARCHY_REQUEST_ERR
(3
)WRONG_DOCUMENT_ERR
(4
)INVALID_CHARACTER_ERR
(5
)NO_DATA_ALLOWED_ERR
(6
)NO_MODIFICATION_ALLOWED_ERR
(7
)NOT_FOUND_ERR
(8
)NOT_SUPPORTED_ERR
(9
)INUSE_ATTRIBUTE_ERR
(10
)INVALID_STATE_ERR
(11
)SYNTAX_ERR
(12
)INVALID_MODIFICATION_ERR
(13
)NAMESPACE_ERR
(14
)INVALID_ACCESS_ERR
(15
)
attributes:
code
with a value matching one of the above constants.
-
method:
hasFeature(feature, version)
createDocumentType(qualifiedName, publicId, systemId)
createDocument(namespaceURI, qualifiedName, doctype)
-
Document : Node
readonly attribute:
doctype
|implementation
|documentElement
method:
createElement(tagName)
createDocumentFragment()
createTextNode(data)
createComment(data)
createCDATASection(data)
createProcessingInstruction(target, data)
createAttribute(name)
createEntityReference(name)
getElementsByTagName(tagname)
importNode(importedNode, deep)
createElementNS(namespaceURI, qualifiedName)
createAttributeNS(namespaceURI, qualifiedName)
getElementsByTagNameNS(namespaceURI, localName)
getElementById(elementId)
-
DocumentFragment : Node
-
Element : Node
readonly attribute:
tagName
method:
getAttribute(name)
setAttribute(name, value)
removeAttribute(name)
getAttributeNode(name)
setAttributeNode(newAttr)
removeAttributeNode(oldAttr)
getElementsByTagName(name)
getAttributeNS(namespaceURI, localName)
setAttributeNS(namespaceURI, qualifiedName, value)
removeAttributeNS(namespaceURI, localName)
getAttributeNodeNS(namespaceURI, localName)
setAttributeNodeNS(newAttr)
getElementsByTagNameNS(namespaceURI, localName)
hasAttribute(name)
hasAttributeNS(namespaceURI, localName)
-
Attr : Node
attribute:
value
readonly attribute:
name
|specified
|ownerElement
-
readonly attribute:
length
method:
item(index)
-
readonly attribute:
length
method:
getNamedItem(name)
setNamedItem(arg)
removeNamedItem(name)
item(index)
getNamedItemNS(namespaceURI, localName)
setNamedItemNS(arg)
removeNamedItemNS(namespaceURI, localName)
-
CharacterData : Node
method:
substringData(offset, count)
appendData(arg)
insertData(offset, arg)
deleteData(offset, count)
replaceData(offset, count, arg)
-
Text : CharacterData
method:
splitText(offset)
-
Comment : CharacterData
-
readonly attribute:
name
|entities
|notations
|publicId
|systemId
|internalSubset
-
Notation : Node
readonly attribute:
publicId
|systemId
-
Entity : Node
readonly attribute:
publicId
|systemId
|notationName
-
EntityReference : Node
-
ProcessingInstruction : Node
attribute:
data
readonly attribute:target
DOM level 3 support:
-
attribute:
textContent
method:
isDefaultNamespace(namespaceURI)
lookupNamespaceURI(prefix)
DOM extension by xmldom
-
[Node] Source position extension;
attribute:
lineNumber
//number starting from1
columnNumber
//number starting from1
Specs
The implementation is based on several specifications:
DOM Parsing and Serialization
From the W3C DOM Parsing and Serialization (WD 2016) xmldom
provides an implementation for the interfaces:
DOMParser
XMLSerializer
Note that there are some known deviations between this implementation and the W3 specifications.
Note: The latest version of this spec has the status "Editors Draft", since it is under active development. One major change is that the definition of the DOMParser
interface has been moved to the HTML spec
DOM
The original author claims that xmldom implements [DOM Level 2] in a "fully compatible" way and some parts of [DOM Level 3], but there are not enough tests to prove this. Both Specifications are now superseded by the [DOM Level 4 aka Living standard] wich has a much broader scope than xmldom.
xmldom implements the following interfaces (most constructors are currently not exposed):
Attr
CDATASection
CharacterData
Comment
Document
DocumentFragment
DocumentType
DOMException
(constructor exposed)DOMImplementation
(constructor exposed)Element
Entity
EntityReference
LiveNodeList
NamedNodeMap
Node
(constructor exposed)NodeList
Notation
ProcessingInstruction
Text
more details are available in the (incomplete) API Reference section.
HTML
xmldom does not have any goal of supporting the full spec, but it has some capability to parse, report and serialize things differently when "detecting HTML" (by checking the default namespace). There is an upcoming change to better align the implementation with the latest specs, related to https://github.com/xmldom/xmldom/issues/203.
SAX, XML, XMLNS
xmldom has an own SAX parser implementation to do the actual parsing, which implements some interfaces in alignment with the Java interfaces SAX defines:
XMLReader
DOMHandler
There is an idea/proposal to make it possible to replace it with something else in https://github.com/xmldom/xmldom/issues/55
![Empty State](/_next/static/media/empty.e5fae2e5.png)
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
dependency not pinned by hash detected -- score normalized to 1
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/examples.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/examples.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/examples.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/examples.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/examples.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/examples.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/examples.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/examples.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stryker.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/stryker.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stryker.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/stryker.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.js.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/test-node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.js.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/test-node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.js.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/test-node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-node.js.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/zeligzhou/xmldom-qsa/test-node.js.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: examples/typescript-node-es6/pretest.sh:6
- Warn: npmCommand not pinned by hash: examples/typescript-node-es6/pretest.sh:7
- Warn: npmCommand not pinned by hash: .github/workflows/examples.yml:30
- Info: 0 out of 10 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 6 npmCommand dependencies pinned
Reason
Found 0/10 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/examples.yml:1
- Warn: no topLevel permission defined: .github/workflows/stryker.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-node.js.yml:1
- Info: no jobLevel write permissions found
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 21 are checked with a SAST tool
Reason
12 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
3.5
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More