fix: add namespace checks

lddubeau · Jul 4, 2018 · 9f94c4b · 9f94c4b
1 parent 30fb540
commit 9f94c4b
Showing 1 changed file with 17 additions and 3 deletions.
diff --git a/lib/saxes.js b/lib/saxes.js
@@ -904,10 +904,24 @@ class SAXParser {
       tag.local = qn.local;
       tag.uri = tag.ns[qn.prefix] || "";
 
-      if (tag.prefix && !tag.uri) {
-        this.fail(`Unbound namespace prefix: ${
+      if (tag.prefix) {
+        if (tag.prefix === "xmlns") {
+          this.fail("Tags may not have \"xmlns\" as prefix.");
+        }
+
+        if (!tag.uri) {
+          this.fail(`Unbound namespace prefix: ${
           JSON.stringify(this.tagName)}`);
-        tag.uri = qn.prefix;
+          tag.uri = qn.prefix;
+        }
+      }
+      else if (tag.uri === XMLNS_NAMESPACE) {
+        this.fail(`The default namespace may not be set to
+${XMLNS_NAMESPACE}.`);
+      }
+      else if (tag.uri === XML_NAMESPACE) {
+        this.fail(`The default namespace may not be set to
+${XML_NAMESPACE}.`);
       }
 
       const parent = this.tags[this.tags.length - 1] || this;