From 14df42b15fabc70472bb23264cf73acf4bfbe83d Mon Sep 17 00:00:00 2001 From: Davanum Srinivas Date: Wed, 20 Feb 2013 11:06:21 -0500 Subject: Additional tests for safe parsing with minidom For nova, forbid_dtd is going to be true always, however if someone picks up this code and tries forbid_dtd = False then the existing code is not good enough. we need to protect against external entities/dtd and not allow notations as well. Added a few more handlers and test cases to cover that use case. Change-Id: If50f690e015f2bf837b403edf552e35d7af8c907 --- nova/tests/test_utils.py | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) (limited to 'nova/tests') diff --git a/nova/tests/test_utils.py b/nova/tests/test_utils.py index 940ddf6ec..2c2c58db9 100644 --- a/nova/tests/test_utils.py +++ b/nova/tests/test_utils.py @@ -23,6 +23,7 @@ import os import os.path import StringIO import tempfile +from xml.dom import minidom import mox import netaddr @@ -1059,3 +1060,47 @@ class StringLengthTestCase(test.TestCase): self.assertRaises(exception.InvalidInput, utils.check_string_length, 'a' * 256, 'name', max_length=255) + + +class SafeParserTestCase(test.TestCase): + def test_external_dtd(self): + xml_string = (""" + + + + html with dtd + """) + + parser = utils.ProtectedExpatParser(forbid_dtd=False, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) + + def test_external_file(self): + xml_string = """ + ]> + ⅇ""" + + parser = utils.ProtectedExpatParser(forbid_dtd=False, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) + + def test_notation(self): + xml_string = """ + + + ]> + + """ + + parser = utils.ProtectedExpatParser(forbid_dtd=False, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) -- cgit