diff options
| author | Steve Clay <steve@mrclay.org> | 2013-07-11 13:24:01 -0400 |
|---|---|---|
| committer | Paweł Sroka <srokap@gmail.com> | 2013-11-04 03:34:21 +0100 |
| commit | d53447f7e6b3277f3249d9a70e56ec01a90c3a60 (patch) | |
| tree | a61fa62cef82fef01254849bbbd70dbf149e854a /engine/tests | |
| parent | 550ef1fe32fc8da940c42359f7a6347e65138c85 (diff) | |
| download | elgg-d53447f7e6b3277f3249d9a70e56ec01a90c3a60.tar.gz elgg-d53447f7e6b3277f3249d9a70e56ec01a90c3a60.tar.bz2 | |
Disable loading external entities during XML parsing
Diffstat (limited to 'engine/tests')
| -rw-r--r-- | engine/tests/regression/trac_bugs.php | 10 | ||||
| -rw-r--r-- | engine/tests/test_files/xxe/external_entity.txt | 1 | ||||
| -rw-r--r-- | engine/tests/test_files/xxe/request.xml | 8 |
3 files changed, 19 insertions, 0 deletions
diff --git a/engine/tests/regression/trac_bugs.php b/engine/tests/regression/trac_bugs.php index ef1348cf6..e6773c8af 100644 --- a/engine/tests/regression/trac_bugs.php +++ b/engine/tests/regression/trac_bugs.php @@ -373,4 +373,14 @@ class ElggCoreRegressionBugsTest extends ElggCoreUnitTest { //delete group and annotations $group->delete(); } + + public function test_ElggXMLElement_does_not_load_external_entities() { + $payload = file_get_contents(dirname(dirname(__FILE__)) . '/test_files/xxe/request.xml'); + $payload = sprintf($payload, 'file://' . realpath(dirname(dirname(__FILE__)) . '/test_files/xxe/external_entity.txt')); + + $el = new ElggXMLElement($payload); + $chidren = $el->getChildren(); + $content = $chidren[0]->getContent(); + $this->assertNoPattern('/secret/', $content); + } } diff --git a/engine/tests/test_files/xxe/external_entity.txt b/engine/tests/test_files/xxe/external_entity.txt new file mode 100644 index 000000000..536aca34d --- /dev/null +++ b/engine/tests/test_files/xxe/external_entity.txt @@ -0,0 +1 @@ +secret
\ No newline at end of file diff --git a/engine/tests/test_files/xxe/request.xml b/engine/tests/test_files/xxe/request.xml new file mode 100644 index 000000000..4390f9db2 --- /dev/null +++ b/engine/tests/test_files/xxe/request.xml @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<!DOCTYPE foo [ +<!ELEMENT methodName ANY > +<!ENTITY xxe SYSTEM "%s" > +]> +<methodCall> + <methodName>test&xxe;test</methodName> +</methodCall> |