[java-shib-shared] branch main updated: JSSH-13 - Add unit tests for XML parser issues

Scott Cantor cantor.2 at osu.edu
Wed Oct 12 13:50:57 UTC 2022


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=8c0b6c68e4e1d83218a2099e240bac1ff03dff80

The following commit(s) were added to refs/heads/main by this push:
     new 8c0b6c68 JSSH-13 - Add unit tests for XML parser issues
8c0b6c68 is described below

commit 8c0b6c68e4e1d83218a2099e240bac1ff03dff80
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Oct 12 09:50:54 2022 -0400

    JSSH-13 - Add unit tests for XML parser issues
    
    https://shibboleth.atlassian.net/browse/JSSH-13
---
 .../shibboleth/shared/xml/impl/WellFormedTest.java | 92 ++++++++++++++++++++++
 .../net/shibboleth/shared/xml/impl/crazyDTD.xml    |  1 +
 .../shibboleth/shared/xml/impl/trailingColon.xml   |  1 +
 .../shared/xml/impl/trailingColonDTD.xml           |  2 +
 4 files changed, 96 insertions(+)

diff --git a/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java b/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java
new file mode 100644
index 00000000..6118f6dc
--- /dev/null
+++ b/shib-support/src/test/java/net/shibboleth/shared/xml/impl/WellFormedTest.java
@@ -0,0 +1,92 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements.  See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License.  You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.shared.xml.impl;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.StringReader;
+import java.util.Map;
+
+import javax.xml.XMLConstants;
+
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+import org.w3c.dom.Document;
+import org.w3c.dom.ls.DOMImplementationLS;
+import org.xml.sax.SAXException;
+
+import net.shibboleth.shared.component.ComponentInitializationException;
+import net.shibboleth.shared.xml.XMLParserException;
+
+/**
+ * Tests for well-formedness bugs.
+ */
+public class WellFormedTest {
+
+    private BasicParserPool parserPool;
+
+    @BeforeClass public void setup()
+            throws XMLParserException, ComponentInitializationException, SAXException, IOException {
+        parserPool = new BasicParserPool();
+        parserPool.setBuilderFeatures(Map.of(
+                XMLConstants.FEATURE_SECURE_PROCESSING, true,
+                "http://apache.org/xml/features/nonvalidating/load-external-dtd", false)
+                );
+        parserPool.initialize();
+    }
+
+    @Test(expectedExceptions=XMLParserException.class)
+    public void test1NoDTD() throws Exception {
+        // This needs to throw an error because xmlns and xmlns: should be seen as duplicated.
+        // With no DTD, this does throw, and we want to make sure it does.
+        // If this ever squawks, the parser was broken by some regression.
+
+        try (final InputStream is = getClass().getResourceAsStream("trailingColon.xml")) {
+            parserPool.parse(is);
+        }
+    }
+
+    @Test(expectedExceptions=XMLParserException.class)
+    public void test1DTD() throws Exception {
+        
+        // This also needs to throw on the parse and does at the moment.
+        // If this ever squawks, the parser was broken by some regression.
+        
+        try (final InputStream is = getClass().getResourceAsStream("trailingColonDTD.xml")) {
+            parserPool.parse(is);
+        }
+    }
+
+    @Test(expectedExceptions=XMLParserException.class, enabled=false)
+    public void test2() throws Exception {
+
+        // This also needs to throw and I think was at one point.
+        // Either my notes are bad or this is a regression in the parser around DTDs.
+        // We're insulated from DTD bugs in our software in practice, but the core code may be suspect.
+        
+        final Document doc1;
+        try (final InputStream is = getClass().getResourceAsStream("crazyDTD.xml")) {
+            doc1 = parserPool.parse(is);
+        }
+        
+        final String s =
+                ((DOMImplementationLS) doc1.getImplementation()).createLSSerializer().writeToString(doc1);
+        parserPool.parse(new StringReader(s));
+    }
+
+}
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml
new file mode 100644
index 00000000..ffe0edf4
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/crazyDTD.xml
@@ -0,0 +1 @@
+<!DOCTYPE x SYSTEM 'x\"><Root><Y/><![CDATA['><Root><X/><![CDATA[x]]></Root>
\ No newline at end of file
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml
new file mode 100644
index 00000000..211f43cd
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColon.xml
@@ -0,0 +1 @@
+<Root><X xmlns='x' xmlns:='y'/></Root>
\ No newline at end of file
diff --git a/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml
new file mode 100644
index 00000000..0908dc7a
--- /dev/null
+++ b/shib-support/src/test/resources/net/shibboleth/shared/xml/impl/trailingColonDTD.xml
@@ -0,0 +1,2 @@
+<!DOCTYPE x>
+<Root><X xmlns='x' xmlns:='y'/></Root>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list