aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--engine/tests/regression/trac_bugs.php21
1 files changed, 13 insertions, 8 deletions
diff --git a/engine/tests/regression/trac_bugs.php b/engine/tests/regression/trac_bugs.php
index ea39253df..689275661 100644
--- a/engine/tests/regression/trac_bugs.php
+++ b/engine/tests/regression/trac_bugs.php
@@ -377,6 +377,7 @@ class ElggCoreRegressionBugsTest extends ElggCoreUnitTest {
public function test_ElggXMLElement_does_not_load_external_entities() {
$elLast = libxml_disable_entity_loader(false);
+ // build payload that should trigger loading of external entity
$payload = file_get_contents(dirname(dirname(__FILE__)) . '/test_files/xxe/request.xml');
$path = realpath(dirname(dirname(__FILE__)) . '/test_files/xxe/external_entity.txt');
$path = str_replace('\\', '/', $path);
@@ -384,16 +385,20 @@ class ElggCoreRegressionBugsTest extends ElggCoreUnitTest {
$path = '/' . $path;
}
$path = 'file://' . $path;
- $payload = sprintf($payload, $path);
+ $payload = sprintf($payload, $path);
- $el = new ElggXMLElement($payload);
- $chidren = $el->getChildren();
- $content = $chidren[0]->getContent();
- $this->assertNoPattern('/secret/', $content);
-
- //make sure the test is valid
+ // make sure we can actually this in this environment
$element = new SimpleXMLElement($payload);
- $this->assertPattern('/secret/', (string)$element->methodName);
+ $can_load_entity = preg_match('/secret/', (string)$element->methodName);
+
+ $this->skipUnless($can_load_entity, "XXE vulnerability cannot be tested on this system");
+
+ if ($can_load_entity) {
+ $el = new ElggXMLElement($payload);
+ $chidren = $el->getChildren();
+ $content = $chidren[0]->getContent();
+ $this->assertNoPattern('/secret/', $content);
+ }
libxml_disable_entity_loader($elLast);
}