Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 8 additions & 10 deletions test/issue_71_test.exs
Original file line number Diff line number Diff line change
@@ -1,37 +1,35 @@
defmodule Issue71Test do
use ExUnit.Case

test "raise on reading /etc/passwd with dtd: :none" do

Check failure on line 4 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test raise on reading /etc/passwd with dtd: :none (Issue71Test)

Check failure on line 4 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test raise on reading /etc/passwd with dtd: :none (Issue71Test)

Check failure on line 4 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test raise on reading /etc/passwd with dtd: :none (Issue71Test)
sneaky_xml = File.read!("./test/files/xxe.xml")

assert {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}} =
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: :none, quiet: true))
end

test "raise on reading /etc/passwd with dtd: :internal_only" do

Check failure on line 11 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test raise on reading /etc/passwd with dtd: :internal_only (Issue71Test)

Check failure on line 11 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test raise on reading /etc/passwd with dtd: :internal_only (Issue71Test)

Check failure on line 11 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test raise on reading /etc/passwd with dtd: :internal_only (Issue71Test)
sneaky_xml = File.read!("./test/files/xxe.xml")

assert {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}} =
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: :internal_only, quiet: true))
end

test "raise on reading /etc/passwd with dtd: [only: :banana]" do

Check failure on line 18 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test raise on reading /etc/passwd with dtd: [only: :banana] (Issue71Test)

Check failure on line 18 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test raise on reading /etc/passwd with dtd: [only: :banana] (Issue71Test)

Check failure on line 18 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test raise on reading /etc/passwd with dtd: [only: :banana] (Issue71Test)
sneaky_xml = File.read!("./test/files/xxe.xml")

assert_raise RuntimeError, fn ->
SweetXml.parse(sneaky_xml, dtd: [only: :banana])
end
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: [only: :banana]))
end

test "raise on billion_laugh.xml with dtd: :none" do

Check failure on line 25 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test raise on billion_laugh.xml with dtd: :none (Issue71Test)

Check failure on line 25 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test raise on billion_laugh.xml with dtd: :none (Issue71Test)

Check failure on line 25 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test raise on billion_laugh.xml with dtd: :none (Issue71Test)
dangerous_xml = File.read!("./test/files/billion_laugh.xml")

assert_raise RuntimeError, fn ->
SweetXml.parse(dangerous_xml, dtd: :none)
end
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(dangerous_xml, dtd: :none))
end

test "stream: raise on reading /etc/passwd with dtd: :none" do

Check failure on line 32 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test stream: raise on reading /etc/passwd with dtd: :none (Issue71Test)

Check failure on line 32 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test stream: raise on reading /etc/passwd with dtd: :none (Issue71Test)

Check failure on line 32 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test stream: raise on reading /etc/passwd with dtd: :none (Issue71Test)
sneaky_xml = File.read!("./test/files/xxe.xml")

_ = Process.flag(:trap_exit, true)
Expand All @@ -41,10 +39,10 @@
Stream.run(SweetXml.stream_tags(sneaky_xml, :banana, dtd: :none, quiet: true))
end)

assert_receive {:EXIT, ^pid, {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}}}
assert_receive {:EXIT, ^pid, {:fatal, {{:error, :entities_not_allowed}, _, _, _}}}
end

test "stream: raise on billion_laugh.xml with dtd: :none" do

Check failure on line 45 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test stream: raise on billion_laugh.xml with dtd: :none (Issue71Test)

Check failure on line 45 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test stream: raise on billion_laugh.xml with dtd: :none (Issue71Test)

Check failure on line 45 in test/issue_71_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test stream: raise on billion_laugh.xml with dtd: :none (Issue71Test)
dangerous_xml = File.read!("./test/files/billion_laugh.xml")

_ = Process.flag(:trap_exit, true)
Expand All @@ -54,6 +52,6 @@
Stream.run(SweetXml.stream_tags(dangerous_xml, :banana, dtd: :none, quiet: true))
end)

assert_receive {:EXIT, ^pid, {%RuntimeError{}, _stacktrace}}
assert_receive {:EXIT, ^pid, {:fatal, {{:error, :entities_not_allowed}, _, _, _}}}
end
end
36 changes: 24 additions & 12 deletions test/sweet_xml_stream_test.exs
Original file line number Diff line number Diff line change
Expand Up @@ -121,21 +121,33 @@
end
end

test "DTD error" do

Check failure on line 124 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test DTD error (SweetXmlStreamTest)

Check failure on line 124 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test DTD error (SweetXmlStreamTest)

Check failure on line 124 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test DTD error (SweetXmlStreamTest)
assert_raise SweetXml.DTDError, "DTD not allowed: lol1", fn ->
"test/files/billion_laugh.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:banana, dtd: :none, quiet: true)
|> Stream.run()
end
Process.flag(:trap_exit, true)

pid =
spawn_link(fn ->
"test/files/billion_laugh.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:banana, dtd: :none, quiet: true)
|> Stream.run()
end)

assert_receive {:EXIT, ^pid, reason}
assert match?({%SweetXml.XmerlFatal{reason: {:error, :entities_not_allowed}}, _}, reason)
end

test "internal only" do

Check failure on line 139 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.16, 25)

test internal only (SweetXmlStreamTest)

Check failure on line 139 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.12, 24)

test internal only (SweetXmlStreamTest)

Check failure on line 139 in test/sweet_xml_stream_test.exs

View workflow job for this annotation

GitHub Actions / mix-test (1.17, 26)

test internal only (SweetXmlStreamTest)
assert_raise SweetXml.DTDError, "no external entity allowed", fn ->
"test/files/xxe.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:result, dtd: :internal_only)
|> Stream.run()
end
Process.flag(:trap_exit, true)

pid =
spawn_link(fn ->
"test/files/xxe.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:result, dtd: :internal_only)
|> Stream.run()
end)

assert_receive {:EXIT, ^pid, reason}
assert match?({%SweetXml.XmerlFatal{reason: {:error, :entities_not_allowed}}, _}, reason)
end
end
Loading