fix(plist): ignore inherited XML entity lookup properties (#4530)

* fix(plist): ignore inherited XML entity lookup properties

* test(firmware): assert composed cleanup error evidence

* test(ghidra): assert cancellation during profile shutdown

* test(jeb): retain Linux ownership prerequisite in isolation

src/domain/propertyListKeys.test.ts

@@ -1,7 +1,20 @@
 import { describe, expect, it } from "vitest";
 import { parse } from "plist";
 
-import { omitPrototypeKeys, parseXmlPropertyList } from "./propertyListKeys.js";
+import {
+  decodeXmlText,
+  omitPrototypeKeys,
+  parseXmlPropertyList,
+} from "./propertyListKeys.js";
+
+it("preserves unknown named entities that collide with object prototype properties", () => {
+  expect(
+    decodeXmlText("&constructor; &toString; &valueOf; &hasOwnProperty;"),
+  ).toBe("&constructor; &toString; &valueOf; &hasOwnProperty;");
+  expect(decodeXmlText("&<>"'AB")).toBe(
+    "&<>\"'AB",
+  );
+});
 
 const plist = (body: string) =>
   `<?xml version="1.0" encoding="UTF-8"?><plist version="1.0">${body}</plist>`;

src/domain/propertyListKeys.ts

@@ -75,7 +75,9 @@ export const decodeXmlText = (text: string): string =>
             : undefined;
       if (codePoint !== undefined)
         return codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : entity;
-      return (name === undefined ? undefined : XML_ENTITIES[name]) ?? entity;
+      return name !== undefined && Object.hasOwn(XML_ENTITIES, name)
+        ? XML_ENTITIES[name]!
+        : entity;
     },
   );