From 9f94c4b7fae81d5c2082c0b72026bedf4b5c8a84 Mon Sep 17 00:00:00 2001
From: Louis-Dominique Dubeau <ldd@lddubeau.com>
Date: Wed, 4 Jul 2018 07:39:13 -0400
Subject: [PATCH] fix: add namespace checks

---
 lib/saxes.js | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/lib/saxes.js b/lib/saxes.js
index 8d27c75f..3015588a 100644
--- a/lib/saxes.js
+++ b/lib/saxes.js
@@ -904,10 +904,24 @@ class SAXParser {
       tag.local = qn.local;
       tag.uri = tag.ns[qn.prefix] || "";
 
-      if (tag.prefix && !tag.uri) {
-        this.fail(`Unbound namespace prefix: ${
+      if (tag.prefix) {
+        if (tag.prefix === "xmlns") {
+          this.fail("Tags may not have \"xmlns\" as prefix.");
+        }
+
+        if (!tag.uri) {
+          this.fail(`Unbound namespace prefix: ${
           JSON.stringify(this.tagName)}`);
-        tag.uri = qn.prefix;
+          tag.uri = qn.prefix;
+        }
+      }
+      else if (tag.uri === XMLNS_NAMESPACE) {
+        this.fail(`The default namespace may not be set to
+${XMLNS_NAMESPACE}.`);
+      }
+      else if (tag.uri === XML_NAMESPACE) {
+        this.fail(`The default namespace may not be set to
+${XML_NAMESPACE}.`);
       }
 
       const parent = this.tags[this.tags.length - 1] || this;