Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,8 @@ jobs:
fail-fast: false
matrix:
include:
- elixir: "1.12"
otp: "24"
- elixir: "1.16"
otp: "25"
- elixir: "1.17"
otp: "26"
otp: "27"
- elixir: "1.18"
otp: "27"
- elixir: "1.19"
Expand Down
18 changes: 8 additions & 10 deletions test/issue_71_test.exs
Original file line number Diff line number Diff line change
Expand Up @@ -4,31 +4,29 @@ defmodule Issue71Test do
test "raise on reading /etc/passwd with dtd: :none" do
sneaky_xml = File.read!("./test/files/xxe.xml")

assert {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}} =
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: :none, quiet: true))
end

test "raise on reading /etc/passwd with dtd: :internal_only" do
sneaky_xml = File.read!("./test/files/xxe.xml")

assert {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}} =
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: :internal_only, quiet: true))
end

test "raise on reading /etc/passwd with dtd: [only: :banana]" do
sneaky_xml = File.read!("./test/files/xxe.xml")

assert_raise RuntimeError, fn ->
SweetXml.parse(sneaky_xml, dtd: [only: :banana])
end
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(sneaky_xml, dtd: [only: :banana]))
end

test "raise on billion_laugh.xml with dtd: :none" do
dangerous_xml = File.read!("./test/files/billion_laugh.xml")

assert_raise RuntimeError, fn ->
SweetXml.parse(dangerous_xml, dtd: :none)
end
assert {:fatal, {{:error, :entities_not_allowed}, _file, _line, _col}} =
catch_exit(SweetXml.parse(dangerous_xml, dtd: :none))
end

test "stream: raise on reading /etc/passwd with dtd: :none" do
Expand All @@ -41,7 +39,7 @@ defmodule Issue71Test do
Stream.run(SweetXml.stream_tags(sneaky_xml, :banana, dtd: :none, quiet: true))
end)

assert_receive {:EXIT, ^pid, {:fatal, {{:error_fetching_DTD, {_, _}}, _file, _line, _col}}}
assert_receive {:EXIT, ^pid, {:fatal, {{:error, :entities_not_allowed}, _, _, _}}}
end

test "stream: raise on billion_laugh.xml with dtd: :none" do
Expand All @@ -54,6 +52,6 @@ defmodule Issue71Test do
Stream.run(SweetXml.stream_tags(dangerous_xml, :banana, dtd: :none, quiet: true))
end)

assert_receive {:EXIT, ^pid, {%RuntimeError{}, _stacktrace}}
assert_receive {:EXIT, ^pid, {:fatal, {{:error, :entities_not_allowed}, _, _, _}}}
end
end
36 changes: 24 additions & 12 deletions test/sweet_xml_stream_test.exs
Original file line number Diff line number Diff line change
Expand Up @@ -122,20 +122,32 @@ defmodule SweetXmlStreamTest do
end

test "DTD error" do
assert_raise SweetXml.DTDError, "DTD not allowed: lol1", fn ->
"test/files/billion_laugh.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:banana, dtd: :none, quiet: true)
|> Stream.run()
end
Process.flag(:trap_exit, true)

pid =
spawn_link(fn ->
"test/files/billion_laugh.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:banana, dtd: :none, quiet: true)
|> Stream.run()
end)

assert_receive {:EXIT, ^pid, reason}
assert match?({%SweetXml.XmerlFatal{reason: {:error, :entities_not_allowed}}, _}, reason)
end

test "internal only" do
assert_raise SweetXml.DTDError, "no external entity allowed", fn ->
"test/files/xxe.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:result, dtd: :internal_only)
|> Stream.run()
end
Process.flag(:trap_exit, true)

pid =
spawn_link(fn ->
"test/files/xxe.xml"
|> File.stream!()
|> SweetXml.stream_tags!(:result, dtd: :internal_only)
|> Stream.run()
end)

assert_receive {:EXIT, ^pid, reason}
assert match?({%SweetXml.XmerlFatal{reason: {:error, :entities_not_allowed}}, _}, reason)
end
end