fix(plist): reject XML dictionary keys without values

Fixes #6682

src/domain/propertyListXml.test.ts

@@ -38,6 +38,17 @@ it("keeps document-level processing instructions outside plist members", () => {
   expect(parsed.numberLiterals.incomplete).toBe(false);
 });
 
+it("rejects a dictionary key without a value and preserves an explicit empty string", () => {
+  expect(() =>
+    parseXmlPropertyList("<plist><dict><key>missing</key></dict></plist>"),
+  ).toThrow("Missing value for key while parsing <dict/>");
+  expect(
+    parseXmlPropertyList(
+      "<plist><dict><key>empty</key><string/></dict></plist>",
+    ).value,
+  ).toEqual({ empty: "" });
+});
+
 it.each([
   ["CDATA", "<![CDATA[before<?rea content?>after]]>"],
   ["escaped text", "before&lt;?rea content?&gt;after"],

src/domain/propertyListXml.ts

@@ -85,7 +85,8 @@ export const decodeXmlPropertyList = (text: string) => {
             key = undefined;
           }
         }
-        if (key !== undefined) entries.push([key, ""]);
+        if (key !== undefined)
+          throw new TypeError("Missing value for key while parsing <dict/>");
         // Define own properties safely, including __proto__; the caller owns omission accounting.
         return Object.fromEntries(entries);
       }