Data serialization ·
Local XML to JSON: DOMParser versus SAX-style walks
XML to JSON in a tab is parse, then walk. DOMParser.parseFromString(xml, 'application/xml') builds a tree. You map elements, attributes, and text into objects using a named convention. Classic XXE against a server parser is a different threat; you still must not execute scripts from SVG and you must detect parsererror.
parseFromString and parsererror
If the documentElement is parsererror or contains one, fail closed. Do not convert a partial tree silently.
Entity expansion
Billion-laughs is a server classic. Browsers have tightened this. Treat huge or weird DOCTYPE as suspicious. XSS in SVG/XML is the HTML-escape article.
Mapping conventions
Parker: elements to keys, attributes dropped or nested. Badgerfish: $ for text, @ for attributes. Mixed content (text + child elements) is the hard case — pick one and test.
Arrays of repeated tags
Three <item> children should become an array, not item, item2. Detect repeats per parent.
JSON to XML is not inverse
Type erasure (everything is string in XML). Namespaces. Use json-to-xml only when you control both ends. Flattened CSV is even lossier (silo 1).
Frequently asked questions
Does browser DOMParser fetch DTDs from the network?
Modern browsers restrict external entity loading in parseFromString. Do not rely on folklore; still avoid passing untrusted XML to server parsers, and check for parsererror nodes.
Why does round-trip JSON lose attributes?
If you only copy textContent, attributes vanish. Badgerfish-style @attr keys preserve them. Document the convention.
Can I parse 100 MB XML this way?
DOMParser builds a full tree. Phones will OOM. Warn and suggest splitting. There is no standard SAX in the browser.