xml2js vs body-parser-xml vs express-xml-bodyparser
Node.js 中 XML 请求体解析方案选型
xml2jsbody-parser-xmlexpress-xml-bodyparser类似的npm包:

Node.js 中 XML 请求体解析方案选型

body-parser-xmlexpress-xml-bodyparserxml2js 都用于在 Node.js 应用中处理 XML 数据,但角色不同。前两者是专为 Express 框架设计的中间件,用于自动解析 HTTP 请求中的 XML body 并挂载到 req.body;而 xml2js 是一个通用的 XML 解析与序列化工具库,不依赖特定 Web 框架,需手动调用进行转换。

npm下载趋势

3 年

GitHub Stars 排名

统计详情

npm包名称
下载量
Stars
大小
Issues
发布时间
License
xml2js30,672,7514,9723.44 MB2483 年前MIT
body-parser-xml03816.4 kB123 年前MIT
express-xml-bodyparser07112 kB117 个月前MIT

Node.js 中 XML 请求体解析方案深度对比:body-parser-xml、express-xml-bodyparser 与 xml2js

在构建接收 XML 格式请求体的 Express 应用时,开发者常面临选择:是使用专为 Express 设计的中间件(如 body-parser-xmlexpress-xml-bodyparser),还是直接调用通用 XML 解析库(如 xml2js)?这三者定位不同,适用场景也各异。本文从真实工程角度出发,深入剖析它们的技术差异、集成方式和实际限制。

📦 核心定位与职责划分

body-parser-xmlexpress-xml-bodyparser 都是 Express 中间件,目标是在请求进入路由处理器前,自动将 req.body 填充为解析后的 JavaScript 对象。它们内部通常依赖像 xml2js 这样的底层解析器。

xml2js 则是一个 通用 XML 解析/序列化工具库,不绑定任何 Web 框架。它提供同步或异步方法,将 XML 字符串转为 JS 对象,或将 JS 对象转回 XML。

💡 关键区别:中间件自动处理请求流;工具库需手动调用。

⚙️ 集成方式与代码示例

使用 body-parser-xml

该包扩展了标准 body-parser,通过 .xml() 方法注册中间件。注意:它要求你先安装 body-parser

// 安装: npm install body-parser body-parser-xml
const express = require('express');
const bodyParser = require('body-parser');
require('body-parser-xml')(bodyParser);

const app = express();

app.use(bodyParser.xml({
  limit: '1MB',
  xmlParseOptions: {
    explicitArray: false,
    ignoreAttrs: true
  }
}));

app.post('/api/data', (req, res) => {
  // req.body 已是解析后的 JS 对象
  console.log(req.body);
  res.json({ received: true });
});

使用 express-xml-bodyparser

这是一个独立的 Express 中间件,无需依赖 body-parser。配置选项直接传给底层解析器(默认是 xml2js)。

// 安装: npm install express-xml-bodyparser
const express = require('express');
const xmlBodyParser = require('express-xml-bodyparser');

const app = express();

app.use(xmlBodyParser({
  limit: '1MB',
  xmlOptions: {
    explicitArray: false,
    ignoreAttrs: true
  }
}));

app.post('/api/data', (req, res) => {
  // req.body 已是解析后的 JS 对象
  console.log(req.body);
  res.json({ received: true });
});

直接使用 xml2js

你需要手动读取原始请求体(例如通过 express.raw() 或自定义中间件),再调用 xml2js 解析。

// 安装: npm install xml2js
const express = require('express');
const { parseStringPromise } = require('xml2js');

const app = express();

// 先获取原始 Buffer
app.use(express.raw({ type: 'application/xml', limit: '1MB' }));

app.post('/api/data', async (req, res) => {
  try {
    // 手动解析 XML Buffer
    const result = await parseStringPromise(req.body.toString());
    console.log(result);
    res.json({ received: true });
  } catch (err) {
    res.status(400).json({ error: 'Invalid XML' });
  }
});

⚠️ 维护状态与项目风险

根据 npm 和 GitHub 仓库信息:

  • body-parser-xml:最后更新于 2017 年,GitHub 仓库已归档(archived),官方标记为不再维护。在新项目中应避免使用。
  • express-xml-bodyparser:最近仍有小版本更新,但活跃度较低。未被官方标记为废弃,但社区支持有限。
  • xml2js:持续维护,是 XML 解析领域的事实标准之一,被众多项目间接依赖。

🛑 重要提示:由于 body-parser-xml 已停止维护,存在安全漏洞无法修复的风险,强烈不建议在新项目中使用

🔧 配置灵活性与错误处理

错误处理机制

  • 中间件方案body-parser-xml / express-xml-bodyparser):解析失败时,通常会触发 Express 的错误处理中间件(即调用 next(err))。你需要注册全局错误处理器捕获 XML 解析异常。
// Express 错误处理中间件
app.use((err, req, res, next) => {
  if (err.message.includes('XML')) {
    return res.status(400).json({ error: 'Malformed XML' });
  }
  next(err);
});
  • xml2js 手动方案:你可以精确控制 try/catch 范围,在特定路由内返回自定义错误响应,无需全局介入。

配置透传能力

两个中间件都允许将选项透传给底层 xml2js 解析器(通过 xmlParseOptionsxmlOptions)。但由于它们封装了一层,某些高级用法(如自定义解析器实例、流式解析)可能无法直接支持。而直接使用 xml2js 则完全开放所有 API。

🧪 适用场景决策树

  • 需要快速集成 XML 解析到 Express 应用,且接受有限维护风险? → 考虑 express-xml-bodyparser(但需自行评估长期维护成本)。
  • 构建新项目,重视长期可维护性和安全性?避免 body-parser-xml,优先考虑手动集成 xml2js
  • 需要精细控制解析过程、错误处理或复用解析逻辑? → 直接使用 xml2js 是更灵活、透明的选择。
  • 应用同时处理 JSON 和 XML? → 可组合使用 express.json() 和基于 xml2js 的自定义中间件,保持一致性。

💡 推荐实践:自定义 XML 中间件

结合 xml2js 的可靠性与中间件的便利性,可编写自己的轻量中间件:

const { parseStringPromise } = require('xml2js');

function xmlBodyParser(options = {}) {
  const { limit = '1MB', ...parseOptions } = options;
  
  return async (req, res, next) => {
    if (req.headers['content-type']?.includes('xml')) {
      try {
        const rawBody = await new Promise((resolve, reject) => {
          let data = '';
          req.on('data', chunk => data += chunk);
          req.on('end', () => resolve(data));
          req.on('error', reject);
        });
        req.body = await parseStringPromise(rawBody, parseOptions);
        next();
      } catch (err) {
        next(new Error('XML_PARSE_ERROR'));
      }
    } else {
      next();
    }
  };
}

// 使用
app.use(xmlBodyParser({ explicitArray: false }));

这种方式既利用了 xml2js 的健壮性,又保留了中间件的简洁接口,且完全可控。

📊 总结对比表

特性body-parser-xmlexpress-xml-bodyparserxml2js
类型Express 中间件Express 中间件通用 XML 工具库
维护状态❌ 已废弃⚠️ 低活跃度✅ 持续维护
集成复杂度低(需 body-parser)低(独立)中(需手动处理流)
错误处理粒度全局(通过 Express 错误中间件)全局路由级(手动 try/catch)
配置灵活性依赖封装层依赖封装层完全开放
适用新项目谨慎评估

💎 结论

对于现代 Node.js 项目,直接使用 xml2js 并辅以自定义中间件是兼顾灵活性、安全性和可维护性的最佳路径。express-xml-bodyparser 可作为临时方案,但需警惕其维护风险;而 body-parser-xml 因已废弃,应彻底排除在技术选型之外。

如何选择: xml2js vs body-parser-xml vs express-xml-bodyparser

  • xml2js:

    xml2js 是成熟、持续维护的 XML 处理标准库,提供完整的解析与构建能力。适合所有新项目,尤其当你需要精细控制解析过程、错误处理或复用逻辑时。推荐结合自定义中间件使用,以获得最佳灵活性和安全性。

  • body-parser-xml:

    body-parser-xml 已被官方标记为废弃(archived),最后更新于 2017 年,存在未修复的安全隐患。新项目绝对不应选用此包。若在旧系统中遇到,应尽快迁移至其他方案。

  • express-xml-bodyparser:

    express-xml-bodyparser 作为独立 Express 中间件,集成简单,适合快速原型或短期项目。但其维护活跃度低,长期项目需评估风险。仅在明确接受其局限性且无需高级 XML 处理功能时考虑使用。

xml2js的README

node-xml2js

Ever had the urge to parse XML? And wanted to access the data in some sane, easy way? Don't want to compile a C parser, for whatever reason? Then xml2js is what you're looking for!

Description

Simple XML to JavaScript object converter. It supports bi-directional conversion. Uses sax-js and xmlbuilder-js.

Note: If you're looking for a full DOM parser, you probably want JSDom.

Installation

Simplest way to install xml2js is to use npm, just npm install xml2js which will download xml2js and all dependencies.

xml2js is also available via Bower, just bower install xml2js which will download xml2js and all dependencies.

Usage

No extensive tutorials required because you are a smart developer! The task of parsing XML should be an easy one, so let's make it so! Here's some examples.

Shoot-and-forget usage

You want to parse XML as simple and easy as possible? It's dangerous to go alone, take this:

var parseString = require('xml2js').parseString;
var xml = "<root>Hello xml2js!</root>"
parseString(xml, function (err, result) {
    console.dir(result);
});

Can't get easier than this, right? This works starting with xml2js 0.2.3. With CoffeeScript it looks like this:

{parseString} = require 'xml2js'
xml = "<root>Hello xml2js!</root>"
parseString xml, (err, result) ->
    console.dir result

If you need some special options, fear not, xml2js supports a number of options (see below), you can specify these as second argument:

parseString(xml, {trim: true}, function (err, result) {
});

Simple as pie usage

That's right, if you have been using xml-simple or a home-grown wrapper, this was added in 0.1.11 just for you:

var fs = require('fs'),
    xml2js = require('xml2js');

var parser = new xml2js.Parser();
fs.readFile(__dirname + '/foo.xml', function(err, data) {
    parser.parseString(data, function (err, result) {
        console.dir(result);
        console.log('Done');
    });
});

Look ma, no event listeners!

You can also use xml2js from CoffeeScript, further reducing the clutter:

fs = require 'fs',
xml2js = require 'xml2js'

parser = new xml2js.Parser()
fs.readFile __dirname + '/foo.xml', (err, data) ->
  parser.parseString data, (err, result) ->
    console.dir result
    console.log 'Done.'

But what happens if you forget the new keyword to create a new Parser? In the middle of a nightly coding session, it might get lost, after all. Worry not, we got you covered! Starting with 0.2.8 you can also leave it out, in which case xml2js will helpfully add it for you, no bad surprises and inexplicable bugs!

Promise usage

var xml2js = require('xml2js');
var xml = '<foo></foo>';

// With parser
var parser = new xml2js.Parser(/* options */);
parser.parseStringPromise(xml).then(function (result) {
  console.dir(result);
  console.log('Done');
})
.catch(function (err) {
  // Failed
});

// Without parser
xml2js.parseStringPromise(xml /*, options */).then(function (result) {
  console.dir(result);
  console.log('Done');
})
.catch(function (err) {
  // Failed
});

Parsing multiple files

If you want to parse multiple files, you have multiple possibilities:

  • You can create one xml2js.Parser per file. That's the recommended one and is promised to always just work.
  • You can call reset() on your parser object.
  • You can hope everything goes well anyway. This behaviour is not guaranteed work always, if ever. Use option #1 if possible. Thanks!

So you wanna some JSON?

Just wrap the result object in a call to JSON.stringify like this JSON.stringify(result). You get a string containing the JSON representation of the parsed object that you can feed to JSON-hungry consumers.

Displaying results

You might wonder why, using console.dir or console.log the output at some level is only [Object]. Don't worry, this is not because xml2js got lazy. That's because Node uses util.inspect to convert the object into strings and that function stops after depth=2 which is a bit low for most XML.

To display the whole deal, you can use console.log(util.inspect(result, false, null)), which displays the whole result.

So much for that, but what if you use eyes for nice colored output and it truncates the output with ? Don't fear, there's also a solution for that, you just need to increase the maxLength limit by creating a custom inspector var inspect = require('eyes').inspector({maxLength: false}) and then you can easily inspect(result).

XML builder usage

Since 0.4.0, objects can be also be used to build XML:

var xml2js = require('xml2js');

var obj = {name: "Super", Surname: "Man", age: 23};

var builder = new xml2js.Builder();
var xml = builder.buildObject(obj);

will result in:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<root>
  <name>Super</name>
  <Surname>Man</Surname>
  <age>23</age>
</root>

At the moment, a one to one bi-directional conversion is guaranteed only for default configuration, except for attrkey, charkey and explicitArray options you can redefine to your taste. Writing CDATA is supported via setting the cdata option to true.

To specify attributes:

var xml2js = require('xml2js');

var obj = {root: {$: {id: "my id"}, _: "my inner text"}};

var builder = new xml2js.Builder();
var xml = builder.buildObject(obj);

will result in:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<root id="my id">my inner text</root>

Adding xmlns attributes

You can generate XML that declares XML namespace prefix / URI pairs with xmlns attributes.

Example declaring a default namespace on the root element:

let obj = { 
  Foo: {
    $: {
      "xmlns": "http://foo.com"
    }   
  }
};  

Result of buildObject(obj):

<Foo xmlns="http://foo.com"/>

Example declaring non-default namespaces on non-root elements:

let obj = {
  'foo:Foo': {
    $: {
      'xmlns:foo': 'http://foo.com'
    },
    'bar:Bar': {
      $: {
        'xmlns:bar': 'http://bar.com'
      }
    }
  }
}

Result of buildObject(obj):

<foo:Foo xmlns:foo="http://foo.com">
  <bar:Bar xmlns:bar="http://bar.com"/>
</foo:Foo>

Processing attribute, tag names and values

Since 0.4.1 you can optionally provide the parser with attribute name and tag name processors as well as element value processors (Since 0.4.14, you can also optionally provide the parser with attribute value processors):


function nameToUpperCase(name){
    return name.toUpperCase();
}

//transform all attribute and tag names and values to uppercase
parseString(xml, {
  tagNameProcessors: [nameToUpperCase],
  attrNameProcessors: [nameToUpperCase],
  valueProcessors: [nameToUpperCase],
  attrValueProcessors: [nameToUpperCase]},
  function (err, result) {
    // processed data
});

The tagNameProcessors and attrNameProcessors options accept an Array of functions with the following signature:

function (name){
  //do something with `name`
  return name
}

The attrValueProcessors and valueProcessors options accept an Array of functions with the following signature:

function (value, name) {
  //`name` will be the node name or attribute name
  //do something with `value`, (optionally) dependent on the node/attr name
  return value
}

Some processors are provided out-of-the-box and can be found in lib/processors.js:

  • normalize: transforms the name to lowercase. (Automatically used when options.normalize is set to true)

  • firstCharLowerCase: transforms the first character to lower case. E.g. 'MyTagName' becomes 'myTagName'

  • stripPrefix: strips the xml namespace prefix. E.g <foo:Bar/> will become 'Bar'. (N.B.: the xmlns prefix is NOT stripped.)

  • parseNumbers: parses integer-like strings as integers and float-like strings as floats E.g. "0" becomes 0 and "15.56" becomes 15.56

  • parseBooleans: parses boolean-like strings to booleans E.g. "true" becomes true and "False" becomes false

Options

Apart from the default settings, there are a number of options that can be specified for the parser. Options are specified by new Parser({optionName: value}). Possible options are:

  • attrkey (default: $): Prefix that is used to access the attributes. Version 0.1 default was @.
  • charkey (default: _): Prefix that is used to access the character content. Version 0.1 default was #.
  • explicitCharkey (default: false) Determines whether or not to use a charkey prefix for elements with no attributes.
  • trim (default: false): Trim the whitespace at the beginning and end of text nodes.
  • normalizeTags (default: false): Normalize all tag names to lowercase.
  • normalize (default: false): Trim whitespaces inside text nodes.
  • explicitRoot (default: true): Set this if you want to get the root node in the resulting object.
  • emptyTag (default: ''): what will the value of empty nodes be. In case you want to use an empty object as a default value, it is better to provide a factory function () => ({}) instead. Without this function a plain object would become a shared reference across all occurrences with unwanted behavior.
  • explicitArray (default: true): Always put child nodes in an array if true; otherwise an array is created only if there is more than one.
  • ignoreAttrs (default: false): Ignore all XML attributes and only create text nodes.
  • mergeAttrs (default: false): Merge attributes and child elements as properties of the parent, instead of keying attributes off a child attribute object. This option is ignored if ignoreAttrs is true.
  • validator (default null): You can specify a callable that validates the resulting structure somehow, however you want. See unit tests for an example.
  • xmlns (default false): Give each element a field usually called '$ns' (the first character is the same as attrkey) that contains its local name and namespace URI.
  • explicitChildren (default false): Put child elements to separate property. Doesn't work with mergeAttrs = true. If element has no children then "children" won't be created. Added in 0.2.5.
  • childkey (default $$): Prefix that is used to access child elements if explicitChildren is set to true. Added in 0.2.5.
  • preserveChildrenOrder (default false): Modifies the behavior of explicitChildren so that the value of the "children" property becomes an ordered array. When this is true, every node will also get a #name field whose value will correspond to the XML nodeName, so that you may iterate the "children" array and still be able to determine node names. The named (and potentially unordered) properties are also retained in this configuration at the same level as the ordered "children" array. Added in 0.4.9.
  • charsAsChildren (default false): Determines whether chars should be considered children if explicitChildren is on. Added in 0.2.5.
  • includeWhiteChars (default false): Determines whether whitespace-only text nodes should be included. Added in 0.4.17.
  • async (default false): Should the callbacks be async? This might be an incompatible change if your code depends on sync execution of callbacks. Future versions of xml2js might change this default, so the recommendation is to not depend on sync execution anyway. Added in 0.2.6.
  • strict (default true): Set sax-js to strict or non-strict parsing mode. Defaults to true which is highly recommended, since parsing HTML which is not well-formed XML might yield just about anything. Added in 0.2.7.
  • attrNameProcessors (default: null): Allows the addition of attribute name processing functions. Accepts an Array of functions with following signature:
    function (name){
        //do something with `name`
        return name
    }
    
    Added in 0.4.14
  • attrValueProcessors (default: null): Allows the addition of attribute value processing functions. Accepts an Array of functions with following signature:
    function (value, name){
      //do something with `name`
      return name
    }
    
    Added in 0.4.1
  • tagNameProcessors (default: null): Allows the addition of tag name processing functions. Accepts an Array of functions with following signature:
    function (name){
      //do something with `name`
      return name
    }
    
    Added in 0.4.1
  • valueProcessors (default: null): Allows the addition of element value processing functions. Accepts an Array of functions with following signature:
    function (value, name){
      //do something with `name`
      return name
    }
    
    Added in 0.4.6

Options for the Builder class

These options are specified by new Builder({optionName: value}). Possible options are:

  • attrkey (default: $): Prefix that is used to access the attributes. Version 0.1 default was @.
  • charkey (default: _): Prefix that is used to access the character content. Version 0.1 default was #.
  • rootName (default root or the root key name): root element name to be used in case explicitRoot is false or to override the root element name.
  • renderOpts (default { 'pretty': true, 'indent': ' ', 'newline': '\n' }): Rendering options for xmlbuilder-js.
    • pretty: prettify generated XML
    • indent: whitespace for indentation (only when pretty)
    • newline: newline char (only when pretty)
  • xmldec (default { 'version': '1.0', 'encoding': 'UTF-8', 'standalone': true }: XML declaration attributes.
    • xmldec.version A version number string, e.g. 1.0
    • xmldec.encoding Encoding declaration, e.g. UTF-8
    • xmldec.standalone standalone document declaration: true or false
  • doctype (default null): optional DTD. Eg. {'ext': 'hello.dtd'}
  • headless (default: false): omit the XML header. Added in 0.4.3.
  • allowSurrogateChars (default: false): allows using characters from the Unicode surrogate blocks.
  • cdata (default: false): wrap text nodes in <![CDATA[ ... ]]> instead of escaping when necessary. Does not add <![CDATA[ ... ]]> if it is not required. Added in 0.4.5.

renderOpts, xmldec,doctype and headless pass through to xmlbuilder-js.

Updating to new version

Version 0.2 changed the default parsing settings, but version 0.1.14 introduced the default settings for version 0.2, so these settings can be tried before the migration.

var xml2js = require('xml2js');
var parser = new xml2js.Parser(xml2js.defaults["0.2"]);

To get the 0.1 defaults in version 0.2 you can just use xml2js.defaults["0.1"] in the same place. This provides you with enough time to migrate to the saner way of parsing in xml2js 0.2. We try to make the migration as simple and gentle as possible, but some breakage cannot be avoided.

So, what exactly did change and why? In 0.2 we changed some defaults to parse the XML in a more universal and sane way. So we disabled normalize and trim so xml2js does not cut out any text content. You can reenable this at will of course. A more important change is that we return the root tag in the resulting JavaScript structure via the explicitRoot setting, so you need to access the first element. This is useful for anybody who wants to know what the root node is and preserves more information. The last major change was to enable explicitArray, so everytime it is possible that one might embed more than one sub-tag into a tag, xml2js >= 0.2 returns an array even if the array just includes one element. This is useful when dealing with APIs that return variable amounts of subtags.

Running tests, development

Build Status Coverage Status Dependency Status

The development requirements are handled by npm, you just need to install them. We also have a number of unit tests, they can be run using npm test directly from the project root. This runs zap to discover all the tests and execute them.

If you like to contribute, keep in mind that xml2js is written in CoffeeScript, so don't develop on the JavaScript files that are checked into the repository for convenience reasons. Also, please write some unit test to check your behaviour and if it is some user-facing thing, add some documentation to this README, so people will know it exists. Thanks in advance!

Getting support

Please, if you have a problem with the library, first make sure you read this README. If you read this far, thanks, you're good. Then, please make sure your problem really is with xml2js. It is? Okay, then I'll look at it. Send me a mail and we can talk. Please don't open issues, as I don't think that is the proper forum for support problems. Some problems might as well really be bugs in xml2js, if so I'll let you know to open an issue instead :)

But if you know you really found a bug, feel free to open an issue instead.