fix: escape comment and CDATA delimiters when building XML (GHSA-gh4j-gqv2-49f6)

[greymoth-jp]

Purpose / Goal

Backport to the v4-maintenance line of the v5 fix for GHSA-gh4j-gqv2-49f6 / CVE-2026-41650 (XML Comment and CDATA Injection via Unescaped Delimiters in XMLBuilder).

On v4 the builder writes comment and CDATA values verbatim:

• src/xmlbuilder/json2xml.js: `<!--${val}-->` and `<![CDATA[${val}]]>`
• src/xmlbuilder/orderedJs2Xml.js: the same two cases for preserveOrder

So a value that contains --> (or --) in a comment, or ]]> in a CDATA section, breaks out and injects arbitrary markup. On the current legacy release (4.5.6):

new XMLBuilder({ cdataPropName: '#cdata' })
  .build({ data: { '#cdata': 'a]]><script>alert(1)</script><![CDATA[b' } })
// => <data><![CDATA[a]]><script>alert(1)</script><![CDATA[b]]></data>

v5 fixed this in fast-xml-builder@1.1.5 (pulled in by 5.7.0, published 2026-04-17). v4 keeps the builder inline, so this applies the same neutralization directly:

• CDATA: ]]> -> ]]]]><![CDATA[> (lossless split, round-trips)
• comment: -- -> - -, and a trailing - -> - (a comment cannot legally contain --)

4.5.6 is the current legacy dist-tag and was published before 5.7.0, so it still reproduces; the fix was not backported.

Type

• Bug Fix
• Refactoring / Technology upgrade
• New Feature

Regression tests added in spec/comments_spec.js and spec/cdata_spec.js covering both the default and preserveOrder builders. Full suite passes (285 specs, 0 failures). Happy to open a tracking issue first if you prefer.