From 869d2bc2ec4d2fef59af23dcb9fde12ea8d5ca08 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:59:11 +0800
Subject: [PATCH] fix(plist): reject XML dictionary keys without values

Fixes #6682
---
 src/domain/propertyListXml.test.ts | 11 +++++++++++
 src/domain/propertyListXml.ts      |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/domain/propertyListXml.test.ts b/src/domain/propertyListXml.test.ts
index 4de709e4be..47efef1c23 100644
--- a/src/domain/propertyListXml.test.ts
+++ b/src/domain/propertyListXml.test.ts
@@ -38,6 +38,17 @@ it("keeps document-level processing instructions outside plist members", () => {
   expect(parsed.numberLiterals.incomplete).toBe(false);
 });
 
+it("rejects a dictionary key without a value and preserves an explicit empty string", () => {
+  expect(() =>
+    parseXmlPropertyList("<plist><dict><key>missing</key></dict></plist>"),
+  ).toThrow("Missing value for key while parsing <dict/>");
+  expect(
+    parseXmlPropertyList(
+      "<plist><dict><key>empty</key><string/></dict></plist>",
+    ).value,
+  ).toEqual({ empty: "" });
+});
+
 it.each([
   ["CDATA", "<![CDATA[before<?rea content?>after]]>"],
   ["escaped text", "before&lt;?rea content?&gt;after"],
diff --git a/src/domain/propertyListXml.ts b/src/domain/propertyListXml.ts
index 757f3602c5..f25d63d524 100644
--- a/src/domain/propertyListXml.ts
+++ b/src/domain/propertyListXml.ts
@@ -85,7 +85,8 @@ export const decodeXmlPropertyList = (text: string) => {
             key = undefined;
           }
         }
-        if (key !== undefined) entries.push([key, ""]);
+        if (key !== undefined)
+          throw new TypeError("Missing value for key while parsing <dict/>");
         // Define own properties safely, including __proto__; the caller owns omission accounting.
         return Object.fromEntries(entries);
       }