blob: 1ccb334b916fdd982939327f08055854c71152cd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
#!/usr/bin/perl
#
# Having 'XML_PARSE_HUGE' enabled can make an application vulnerable to
# denial of service through entity expansion attacks. This test script
# confirms that huge document mode is disabled by default and that this
# does not adversely affect expansion of sensible entity definitions.
#
use strict;
use warnings;
use Test::More;
use XML::LibXML;
if (XML::LibXML::LIBXML_VERSION() < 20700) {
plan skip_all => "XML_PARSE_HUGE option not supported for libxml2 < 2.7.0";
}
else {
plan tests => 5;
}
my $benign_xml = <<'EOF';
<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "haha">
]>
<lolz>&lol;</lolz>
EOF
my $evil_xml = <<'EOF';
<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>
EOF
my($parser, $doc);
$parser = XML::LibXML->new;
#$parser->set_option(huge => 0);
# TEST
ok(!$parser->get_option('huge'), "huge mode disabled by default");
$doc = eval { $parser->parse_string($evil_xml); };
# TEST
isnt("$@", "", "exception thrown during parse");
# TEST
like($@, qr/entity.*loop/si, "exception refers to entity reference loop");
$parser = XML::LibXML->new;
$doc = eval { $parser->parse_string($benign_xml); };
# TEST
is("$@", "", "no exception thrown during parse");
my $body = $doc->findvalue( '/lolz' );
# TEST
is($body, 'haha', 'entity was parsed and expanded correctly');
exit;
|
