package.json

@@ -6,7 +6,7 @@
     "json"
   ],
   "homepage": "https://github.com/Leonidas-from-XIV/node-xml2js",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "author": "Marek Kubica <marek@xivilization.net> (https://xivilization.net)",
   "contributors": [
     "maqr <maqr.lollerskates@gmail.com> (https://github.com/maqr)",
@@ -79,12 +79,12 @@
     "xmlbuilder": "~11.0.0"
   },
   "devDependencies": {
-    "coffee-script": ">=1.10.0",
+    "coffeescript": ">=1.10.0 <2",
     "coveralls": "^3.0.1",
     "diff": ">=1.0.8",
     "docco": ">=0.6.2",
     "nyc": ">=2.2.1",
-    "zap": ">=0.2.9"
+    "zap": ">=0.2.9 <1"
   },
   "engines": {
     "node": ">=4.0.0"

src/parser.coffee

@@ -15,6 +15,15 @@ processItem = (processors, item, key) ->
   item = process(item, key) for process in processors
   return item
 
+defineProperty = (obj, key, value) ->
+  # make sure the descriptor hasn't been prototype polluted
+  descriptor = Object.create null
+  descriptor.value = value
+  descriptor.writeable = true
+  descriptor.enumerable = true
+  descriptor.configurable = true
+  Object.defineProperty obj, key, descriptor
+
 class exports.Parser extends events
   constructor: (opts) ->
     # if this was called without 'new', create an instance with new and return
@@ -54,11 +63,12 @@ class exports.Parser extends events
   assignOrPush: (obj, key, newValue) =>
     if key not of obj
       if not @options.explicitArray
-        obj[key] = newValue
+        defineProperty obj, key, newValue
       else
-        obj[key] = [newValue]
+        defineProperty obj, key, [newValue]
     else
-      obj[key] = [obj[key]] if not (obj[key] instanceof Array)
+      unless obj[key] instanceof Array
+        defineProperty obj, key, [obj[key]]
       obj[key].push newValue
 
   reset: =>
@@ -102,18 +112,18 @@ class exports.Parser extends events
     charkey = @options.charkey
 
     @saxParser.onopentag = (node) =>
-      obj = Object.create(null)
+      obj = {}
       obj[charkey] = ""
       unless @options.ignoreAttrs
         for own key of node.attributes
           if attrkey not of obj and not @options.mergeAttrs
-            obj[attrkey] = Object.create(null)
+            obj[attrkey] = {}
           newValue = if @options.attrValueProcessors then processItem(@options.attrValueProcessors, node.attributes[key], key) else node.attributes[key]
           processedKey = if @options.attrNameProcessors then processItem(@options.attrNameProcessors, key) else key
           if @options.mergeAttrs
             @assignOrPush obj, processedKey, newValue
           else
-            obj[attrkey][processedKey] = newValue
+            defineProperty obj[attrkey], processedKey, newValue
 
       # need a place to store the node name
       obj["#name"] = if @options.tagNameProcessors then processItem(@options.tagNameProcessors, node.name) else node.name
@@ -163,7 +173,7 @@ class exports.Parser extends events
       # put children into <childkey> property and unfold chars if necessary
       if @options.explicitChildren and not @options.mergeAttrs and typeof obj is 'object'
         if not @options.preserveChildrenOrder
-          node = Object.create(null)
+          node = {}
           # separate attributes
           if @options.attrkey of obj
             node[@options.attrkey] = obj[@options.attrkey]
@@ -181,9 +191,9 @@ class exports.Parser extends events
           # append current node onto parent's <childKey> array
           s[@options.childkey] = s[@options.childkey] or []
           # push a clone so that the node in the children array can receive the #name property while the original obj can do without it
-          objClone = Object.create(null)
+          objClone = {}
           for own key of obj
-            objClone[key] = obj[key]
+            defineProperty objClone, key, obj[key]
           s[@options.childkey].push objClone
           delete obj["#name"]
           # re-check whether we can collapse the node now to just the charkey value
@@ -198,8 +208,8 @@ class exports.Parser extends events
         if @options.explicitRoot
           # avoid circular references
           old = obj
-          obj = Object.create(null)
-          obj[nodeName] = old
+          obj = {}
+          defineProperty obj, nodeName, old
 
         @resultObject = obj
         # parsing has ended, mark that so we won't throw exceptions from

test/parser.test.coffee

@@ -547,13 +547,13 @@ module.exports =
 
   'test single attrNameProcessors': skeleton(attrNameProcessors: [nameToUpperCase], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10
-    equ {}.hasOwnProperty.call(r.sample.attrNameProcessTest[0].$, 'CAMELCASEATTR'), true
-    equ {}.hasOwnProperty.call(r.sample.attrNameProcessTest[0].$, 'LOWERCASEATTR'), true)
+    equ r.sample.attrNameProcessTest[0].$.hasOwnProperty('CAMELCASEATTR'), true
+    equ r.sample.attrNameProcessTest[0].$.hasOwnProperty('LOWERCASEATTR'), true)
 
   'test multiple attrNameProcessors': skeleton(attrNameProcessors: [nameToUpperCase, nameCutoff], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10
-    equ {}.hasOwnProperty.call(r.sample.attrNameProcessTest[0].$, 'CAME'), true
-    equ {}.hasOwnProperty.call(r.sample.attrNameProcessTest[0].$, 'LOWE'), true)
+    equ r.sample.attrNameProcessTest[0].$.hasOwnProperty('CAME'), true
+    equ r.sample.attrNameProcessTest[0].$.hasOwnProperty('LOWE'), true)
 
   'test single attrValueProcessors': skeleton(attrValueProcessors: [nameToUpperCase], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10
@@ -575,21 +575,21 @@ module.exports =
 
   'test single tagNameProcessors': skeleton(tagNameProcessors: [nameToUpperCase], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10
-    equ {}.hasOwnProperty.call(r, 'SAMPLE'), true
-    equ {}.hasOwnProperty.call(r.SAMPLE, 'TAGNAMEPROCESSTEST'), true)
+    equ r.hasOwnProperty('SAMPLE'), true
+    equ r.SAMPLE.hasOwnProperty('TAGNAMEPROCESSTEST'), true)
 
   'test single tagNameProcessors in simple callback': (test) ->
     fs.readFile fileName, (err, data) ->
       xml2js.parseString data, tagNameProcessors: [nameToUpperCase], (err, r)->
         console.log 'Result object: ' + util.inspect r, false, 10
-        equ {}.hasOwnProperty.call(r, 'SAMPLE'), true
-        equ {}.hasOwnProperty.call(r.SAMPLE, 'TAGNAMEPROCESSTEST'), true
+        equ r.hasOwnProperty('SAMPLE'), true
+        equ r.SAMPLE.hasOwnProperty('TAGNAMEPROCESSTEST'), true
         test.finish()
 
   'test multiple tagNameProcessors': skeleton(tagNameProcessors: [nameToUpperCase, nameCutoff], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10
-    equ {}.hasOwnProperty.call(r, 'SAMP'), true
-    equ {}.hasOwnProperty.call(r.SAMP, 'TAGN'), true)
+    equ r.hasOwnProperty('SAMP'), true
+    equ r.SAMP.hasOwnProperty('TAGN'), true)
 
   'test attrValueProcessors key param': skeleton(attrValueProcessors: [replaceValueByName], (r)->
     console.log 'Result object: ' + util.inspect r, false, 10