new capacity bits (#67)

tests/fixtures/xxe/javascript/irrelevant_xml_call.js

@@ -0,0 +1,8 @@
+// Baseline: tainted body flows through a non-parser string operation.
+// No XML parser entry point, no XXE label classification.
+function handle(req, res) {
+    const body = req.query.xml;
+    res.send("<wrap>" + body + "</wrap>");
+}
+
+module.exports = { handle };

tests/fixtures/xxe/javascript/safe_xxe.js

@@ -0,0 +1,14 @@
+// Safe: tainted XML reaches xml2js.parseString with default options.
+// xml2js does not expand external entities unless explicitly configured;
+// the gate's dangerous_kwargs list (`processEntities`/`explicitEntities`/
+// `strict`) is empty in the literal, so the gate suppresses the finding.
+const xml2js = require("xml2js");
+
+function handle(req, res) {
+    const body = req.query.xml;
+    xml2js.parseString(body, { explicitArray: false }, (err, result) => {
+        res.json(result);
+    });
+}
+
+module.exports = { handle };

tests/fixtures/xxe/javascript/unsafe_fast_xml_parser.js

@@ -0,0 +1,17 @@
+// Unsafe: tainted XML reaches a fast-xml-parser instance whose
+// constructor was explicitly opted into entity resolution
+// (`processEntities: true`).  fast-xml-parser is XXE-safe by default,
+// but this opt-in form is the documented unsafe escape hatch.  The
+// constructor-driven fact is captured in `XmlParserConfigResult`
+// (`external_entities = true`) and the `parser.parse(xml)` call adds
+// Cap::XXE on top of the otherwise empty sink_caps.
+const { XMLParser } = require("fast-xml-parser");
+
+function handle(req, res) {
+    const body = req.query.xml;
+    const parser = new XMLParser({ processEntities: true });
+    const result = parser.parse(body);
+    res.json(result);
+}
+
+module.exports = { handle };

tests/fixtures/xxe/javascript/unsafe_xxe.js

@@ -0,0 +1,12 @@
+// Unsafe: tainted XML reaches xml2js.parseString with `processEntities: true`,
+// activating the XXE gate.
+const xml2js = require("xml2js");
+
+function handle(req, res) {
+    const body = req.query.xml;
+    xml2js.parseString(body, { processEntities: true }, (err, result) => {
+        res.json(result);
+    });
+}
+
+module.exports = { handle };