From a766423f5984b64987e41f7d9cc1848f29151fe8 Mon Sep 17 00:00:00 2001
From: Shaisolaris <66793913+Shaisolaris@users.noreply.github.com>
Date: Tue, 13 Oct 2026 02:32:46 +0000
Subject: [PATCH] fix: validator; reject an XML declaration inside an element

---
 spec/validator_spec.js | 9 +++++++++
 src/validator.js       | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/spec/validator_spec.js b/spec/validator_spec.js
index d1cf43bc..6ad8198e 100644
--- a/spec/validator_spec.js
+++ b/spec/validator_spec.js
@@ -267,6 +267,15 @@ describe("XML Validator", function () {
         });
     });
 
+    it("should not validate XML declaration inside an element", function () {
+        validate("<foo><?xml version=\"1.0\"?></foo>", {
+            InvalidXml: "XML declaration allowed only at the start of the document."
+        });
+        validate("<foo>bar<?xml?></foo>", {
+            InvalidXml: "XML declaration allowed only at the start of the document."
+        });
+    });
+
     it("should not validate XML with prolog only", function () {
         validate("<?xml version=\"1.0\" standalone=\"yes\" ?><!--some comment -  end in this line-->", {
             InvalidXml: "Start tag expected."
diff --git a/src/validator.js b/src/validator.js
index 6f9904f0..6ba4a0b8 100644
--- a/src/validator.js
+++ b/src/validator.js
@@ -149,7 +149,7 @@ export function validate(xmlData, options) {
               i = readCommentAndCDATA(xmlData, i);
               continue;
             } else if (xmlData[i + 1] === '?') {
-              i = readPI(xmlData, ++i);
+              i = readPI(xmlData, i + 2);
               if (i.err) return i;
             } else {
               break;