fix: escape FinTS control characters in HNSHA/HNSHK/HNVSK segments + CVE-2026-26278

[Copilot]

Passwords or usernames containing FinTS control characters (@, +, :, ', ?) were serialized raw in three outbound segments. On ING, a PIN like abc@xyz causes the server to interpret @xyz as a binary-length prefix inside the HNVSD inner payload → error 9010 / dialog aborted (9800).

Escaping fixes

HKIDN already used Format.stringEscaped() correctly; the three affected segments did not:

Segment	Field	Before	After
HNSHA	pin, tan	raw	Format.stringEscaped()
HNSHK	name	raw	Format.stringEscaped()
HNVSK	name	raw	Format.stringEscaped()

// hnsha.ts — before
return [Format.num(secRef), Format.empty(), tan ? [pin, tan] : pin];

// after
return [Format.num(secRef), Format.empty(), tan ? [Format.stringEscaped(pin), Format.stringEscaped(tan)] : Format.stringEscaped(pin)];

Tests

Added serialization round-trip cases to all three test files covering @ and + in the affected fields, e.g. secret@pass → secret?@pass, user@example.com → user?@example.com. HNVSK also exercises deserialization since parse() already unescapes ?@ → @.

Dependency

Bumped fast-xml-parser from ^5.3.3 to ^5.5.6 to address CVE-2026-26278 (numeric entity expansion bypassing entity expansion limits). The CLI has no direct dependency on fast-xml-parser and picks up the fix transitively through fints-lib.

Version

fints-lib bumped 0.8.0 → 0.9.0.

[larsdecker]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Done — merged origin/master into this branch (commit 9b49b4c). The only conflict was in yarn.lock; it was resolved by taking master's lock file as the base and re-running npm install so our ^5.5.6 constraint is correctly reflected. All 309 tests pass.

[Copilot]

Pull request overview

This PR fixes outbound FinTS serialization for credentials containing FinTS control characters in security-related segments (HNSHA/HNSHK/HNVSK) and updates fast-xml-parser to address CVE-2026-26278 in fints-lib.

Changes:

• Escape FinTS control characters in HNSHA.pin/tan, HNSHK.name, and HNVSK.name using Format.stringEscaped().
• Add segment serialization/deserialization test cases covering @ and + escaping.
• Bump fast-xml-parser dependency (and update lockfile) and bump fints-lib version to 0.9.0.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
yarn.lock	Lockfile updates for dependency bump(s); currently includes absolute-path workspace keys.
packages/fints/package.json	Bumps fints-lib version and fast-xml-parser dependency range.
packages/fints/src/segments/hnsha.ts	Escapes pin/tan during serialization.
packages/fints/src/segments/hnshk.ts	Escapes name during serialization.
packages/fints/src/segments/hnvsk.ts	Escapes name during serialization.
packages/fints/src/segments/tests/test-hnsha.ts	Adds escaping coverage for PIN/TAN serialization.
packages/fints/src/segments/tests/test-hnshk.ts	Adds escaping coverage for name serialization; updates date/time mocking.
packages/fints/src/segments/tests/test-hnvsk.ts	Adds escaping + unescaping coverage for name; updates date/time mocking.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

jest.spyOn(Format, "date/time").mockReturnValue(...) is executed at module load and never restored. Since the package’s Jest config doesn’t enable restoreMocks, these mocks can leak into other test files in the same run. Add an afterAll/afterEach that restores mocks (or scope the spies inside a describe with proper teardown) so other tests aren’t affected.

[Copilot]

jest.spyOn(Format, "date/time").mockReturnValue(...) is executed at module load and never restored. Since the package’s Jest config doesn’t enable restoreMocks, these mocks can leak into other test files in the same run. Add an afterAll/afterEach that restores mocks (or scope the spies inside a describe with proper teardown) so other tests aren’t affected.

[larsdecker]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Done in 4aad7be. Added afterAll(() => jest.restoreAllMocks()) at the top level of both test-hnshk.ts and test-hnvsk.ts so the Format.date/Format.time spies are restored after all tests in each file complete, preventing them from leaking into other test files.