fix: raise CardDAV parser entity cap for large address books#231
Open
salmonumbrella wants to merge 2 commits into
Open
fix: raise CardDAV parser entity cap for large address books#231salmonumbrella wants to merge 2 commits into
salmonumbrella wants to merge 2 commits into
Conversation
fast-xml-parser >=4.5.5 defaults processEntities.maxTotalExpansions to 1000. A CardDAV addressbook-query REPORT for a large address book carries far more counted entity references than that (</>/" in vCard data), so parseCards threw "Entity expansion limit exceeded" and the whole sync failed. Lift the count cap. Passing an object for processEntities also flips maxExpansionDepth from its boolean-mode default of 10 to 10000, so pin it back to 10 to keep this change scoped to the single intended knob. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Use a generous finite expansion cap while preserving the previous depth setting without claiming fast-xml-parser enforces it. Reject top-level 507 multistatus responses before extracting cards so truncated snapshots cannot return partial results.
|
Thanks for opening this as part of my bug report. 🙏🏼🙏🏼 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Large CardDAV address-book REPORTs can exceed fast-xml-parser's default entity-expansion limit. This change raises that limit to a generous finite cap and fails closed when a server reports a truncated snapshot.
Changes
10_000_000total-expansion cap while preserving the previous depth setting507 Insufficient Storagemultistatus responses before extracting any cardsTesting
npx vitest run— 11 test files, 276 tests passed under Node 22.20.0npm run lintnode --check src/index.jsgit diff --check main...HEADContributor License Agreement
By submitting this pull request I confirm that: