[core-http] delay saving of DOM parser error namespace

We eagerly save the namespace of "parsererror" element on module load. It's
unnecessary because in most scenarios we would not encounter a parse error.
Furthermore, it caused Content Security Policy error in Chrome version 86.0 or
newer because the returned DOM object for parser errors contains some CSS
styles.

This change fixes the issue by lazily loading the error namespace when the
parsed DOM document contains "parsererror" elements.

Fixes Azure#13268

sdk/core/core-http/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 1.2.3 (Unreleased)
 
+- Browser XML parser now lazily load parser error namespace into cache. Fixed [issue 13268](https://github.com/Azure/azure-sdk-for-js/issues/13268)
 
 ## 1.2.2 (2021-01-07)
 

sdk/core/core-http/src/util/xml.browser.ts

@@ -30,19 +30,29 @@ export function parseXML(str: string, opts: SerializerOptions = {}): Promise<any
   }
 }
 
-let errorNS = "";
-try {
-  errorNS = parser.parseFromString("INVALID", "text/xml").getElementsByTagName("parsererror")[0]
-    .namespaceURI!;
-} catch (ignored) {
-  // Most browsers will return a document containing <parsererror>, but IE will throw.
+let errorNS: string | undefined;
+
+function getErrorNamespace(): string {
+  if (errorNS === undefined) {
+    try {
+      errorNS =
+        parser.parseFromString("INVALID", "text/xml").getElementsByTagName("parsererror")[0]
+          .namespaceURI! ?? "";
+    } catch (ignored) {
+      // Most browsers will return a document containing <parsererror>, but IE will throw.
+      errorNS = "";
+    }
+  }
+  return errorNS;
 }
 
 function throwIfError(dom: Document): void {
-  if (errorNS) {
-    const parserErrors = dom.getElementsByTagNameNS(errorNS, "parsererror");
-    if (parserErrors.length) {
-      throw new Error(parserErrors.item(0)!.innerHTML);
+  const parserErrors = dom.getElementsByTagName("parsererror");
+  if (parserErrors.length > 0 && getErrorNamespace()) {
+    for (let i = 0; i < parserErrors.length; i++) {
+      if (parserErrors[i].namespaceURI === errorNS) {
+        throw new Error(parserErrors[i].innerHTML);
+      }
     }
   }
 }

sdk/core/core-http/test/xmlTests.ts

@@ -41,6 +41,11 @@ describe("XML serializer", function() {
       assert.deepStrictEqual(xml, ``);
     });
 
+    it("with <parsererror> element", async function() {
+      const xml: any = await parseXML(`<errors><parsererror>error 1</parsererror></errors>`);
+      assert.deepStrictEqual(xml, { parsererror: "error 1" });
+    });
+
     it("with empty element with attribute", async function() {
       const xml: any = await parseXML(`<fruit healthy="true" />`);
       assert.deepStrictEqual(xml, {

sdk/core/core-xml/src/xml.browser.ts

@@ -31,19 +31,30 @@ export function parseXML(str: string, opts: XmlOptions = {}): Promise<any> {
   }
 }
 
-let errorNS = "";
-try {
-  errorNS = parser.parseFromString("INVALID", "text/xml").getElementsByTagName("parsererror")[0]
-    .namespaceURI!;
-} catch (ignored) {
-  // Most browsers will return a document containing <parsererror>, but IE will throw.
+let errorNS: string | undefined;
+
+function getErrorNamespace(): string {
+  if (errorNS === undefined) {
+    try {
+      errorNS =
+        parser.parseFromString("INVALID", "text/xml").getElementsByTagName("parsererror")[0]
+          .namespaceURI! ?? "";
+    } catch (ignored) {
+      // Most browsers will return a document containing <parsererror>, but IE will throw.
+      errorNS = "";
+    }
+  }
+
+  return errorNS;
 }
 
 function throwIfError(dom: Document): void {
-  if (errorNS) {
-    const parserErrors = dom.getElementsByTagNameNS(errorNS, "parsererror");
-    if (parserErrors.length) {
-      throw new Error(parserErrors.item(0)!.innerHTML);
+  const parserErrors = dom.getElementsByTagName("parsererror");
+  if (parserErrors.length > 0 && getErrorNamespace()) {
+    for (let i = 0; i < parserErrors.length; i++) {
+      if (parserErrors[i].namespaceURI === errorNS) {
+        throw new Error(parserErrors[i].innerHTML);
+      }
     }
   }
 }