JS prototype chain properties should not be treated as entities

[karfau]

Source code using in instead of Object.hasOwnProperty:

xmldom/lib/sax.js

Lines 68 to 69 in 40745c6

	if(k in entityMap){
	return entityMap[k];

import { DOMParser, XMLSerializer } from '@xmldom/xmldom';

const source = `<xml>&hasOwnProperty; &__proto__; &constructor;</xml>`;

const doc = new DOMParser({ errorHandler: console.error }).parseFromString(
  source,
  'text/xml'
);
console.log(
  doc.documentElement.toString()
);

leads to the output
<xml>function hasOwnProperty() { [native code] </xml>

Try it: https://stackblitz.com/edit/js-xmldom370?devtoolsheight=33&file=index.js