[java-shib-shared] branch main updated: JSSH-13 - Add unit tests for XML parser issues
Scott Cantor
cantor.2 at osu.edu
Wed Oct 12 13:50:57 UTC 2022
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository java-shib-shared.
View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=8c0b6c68e4e1d83218a2099e240bac1ff03dff80
The following commit(s) were added to refs/heads/main by this push:
new 8c0b6c68 JSSH-13 - Add unit tests for XML parser issues
8c0b6c68 is described below
commit 8c0b6c68e4e1d83218a2099e240bac1ff03dff80
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 12 09:50:54 2022 -0400
JSSH-13 - Add unit tests for XML parser issues
https://shibboleth.atlassian.net/browse/JSSH-13
---
.../shibboleth/shared/xml/impl/WellFormedTest.java | 92 ++++++++++++++++++++++
.../net/shibboleth/shared/xml/impl/crazyDTD.xml | 1 +
.../shibboleth/shared/xml/impl/trailingColon.xml | 1 +
.../shared/xml/impl/trailingColonDTD.xml | 2 +
4 files changed, 96 insertions(+)
diff --git a/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java b/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java
new file mode 100644
index 00000000..6118f6dc
--- /dev/null
+++ b/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.shared.xml.impl;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringReader;
+import java.util.Map;
+
+import javax.xml.XMLConstants;
+
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.ls.DOMImplementationLS;
+import org.xml.sax.SAXException;
+
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.xml.XMLParserException;
+
+/**
+ * Tests for well-formedness bugs.
+ */
+public class WellFormedTest {
+
+ private BasicParserPool parserPool;
+
+ @BeforeClass public void setup()
+ throws XMLParserException, ComponentInitializationException, SAXException, IOException {
+ parserPool = new BasicParserPool();
+ parserPool.setBuilderFeatures(Map.of(
+ XMLConstants.FEATURE_SECURE_PROCESSING, true,
+ "http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
+ );
+ parserPool.initialize();
+ }
+
+ @Test(expectedExceptions=XMLParserException.class)
+ public void test1NoDTD() throws Exception {
+ // This needs to throw an error because xmlns and xmlns: should be seen as duplicated.
+ // With no DTD, this does throw, and we want to make sure it does.
+ // If this ever squawks, the parser was broken by some regression.
+
+ try (final InputStream is = getClass().getResourceAsStream("trailingColon.xml")) {
+ parserPool.parse(is);
+ }
+ }
+
+ @Test(expectedExceptions=XMLParserException.class)
+ public void test1DTD() throws Exception {
+
+ // This also needs to throw on the parse and does at the moment.
+ // If this ever squawks, the parser was broken by some regression.
+
+ try (final InputStream is = getClass().getResourceAsStream("trailingColonDTD.xml")) {
+ parserPool.parse(is);
+ }
+ }
+
+ @Test(expectedExceptions=XMLParserException.class, enabled=false)
+ public void test2() throws Exception {
+
+ // This also needs to throw and I think was at one point.
+ // Either my notes are bad or this is a regression in the parser around DTDs.
+ // We're insulated from DTD bugs in our software in practice, but the core code may be suspect.
+
+ final Document doc1;
+ try (final InputStream is = getClass().getResourceAsStream("crazyDTD.xml")) {
+ doc1 = parserPool.parse(is);
+ }
+
+ final String s =
+ ((DOMImplementationLS) doc1.getImplementation()).createLSSerializer().writeToString(doc1);
+ parserPool.parse(new StringReader(s));
+ }
+
+}
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml
new file mode 100644
index 00000000..ffe0edf4
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml
@@ -0,0 +1 @@
+<!DOCTYPE x SYSTEM 'x\"><Root><Y/><![CDATA['><Root><X/><![CDATA[x]]></Root>
\ No newline at end of file
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml
new file mode 100644
index 00000000..211f43cd
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml
@@ -0,0 +1 @@
+<Root><X xmlns='x' xmlns:='y'/></Root>
\ No newline at end of file
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml
new file mode 100644
index 00000000..0908dc7a
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml
@@ -0,0 +1,2 @@
+<!DOCTYPE x>
+<Root><X xmlns='x' xmlns:='y'/></Root>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list