diff options
| author | Davanum Srinivas <dims@linux.vnet.ibm.com> | 2013-02-26 11:26:24 -0500 |
|---|---|---|
| committer | Davanum Srinivas <dims@linux.vnet.ibm.com> | 2013-02-26 12:19:54 -0500 |
| commit | 0d7417cff68e74f636d371529998e275e2765be8 (patch) | |
| tree | 5666959a2785419754bb1e39a21273c8f2e8a8d9 /tests/unit/test_xmlutils.py | |
| parent | bf6c0871d737da802fbb2e70d2481712ac94a1bd (diff) | |
| download | oslo-0d7417cff68e74f636d371529998e275e2765be8.tar.gz oslo-0d7417cff68e74f636d371529998e275e2765be8.tar.xz oslo-0d7417cff68e74f636d371529998e275e2765be8.zip | |
Port safe parsing with minidom patches from Nova
Prevent attacks through xml entity expansion etc.
Fixes LP# 1100282
Change-Id: I391531deac122697556c282184c8f8890ea66489
Diffstat (limited to 'tests/unit/test_xmlutils.py')
| -rw-r--r-- | tests/unit/test_xmlutils.py | 101 |
1 files changed, 101 insertions, 0 deletions
diff --git a/tests/unit/test_xmlutils.py b/tests/unit/test_xmlutils.py new file mode 100644 index 0000000..c38e223 --- /dev/null +++ b/tests/unit/test_xmlutils.py @@ -0,0 +1,101 @@ +# vim: tabstop=4 shiftwidth=4 softtabstop=4 + +# Copyright 2013 IBM +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import datetime +import StringIO +from xml.dom import minidom + +from openstack.common import xmlutils +from tests import utils + + +class XMLUtilsTestCase(utils.BaseTestCase): + def test_safe_parse_xml(self): + + normal_body = (""" + <?xml version="1.0" ?><foo> + <bar> + <v1>hey</v1> + <v2>there</v2> + </bar> + </foo>""").strip() + + def killer_body(): + return (("""<!DOCTYPE x [ + <!ENTITY a "%(a)s"> + <!ENTITY b "%(b)s"> + <!ENTITY c "%(c)s">]> + <foo> + <bar> + <v1>%(d)s</v1> + </bar> + </foo>""") % { + 'a': 'A' * 10, + 'b': '&a;' * 10, + 'c': '&b;' * 10, + 'd': '&c;' * 9999, + }).strip() + + dom = xmlutils.safe_minidom_parse_string(normal_body) + self.assertEqual(normal_body, str(dom.toxml())) + + self.assertRaises(ValueError, + xmlutils.safe_minidom_parse_string, + killer_body()) + + +class SafeParserTestCase(utils.BaseTestCase): + def test_external_dtd(self): + xml_string = ("""<?xml version="1.0" encoding="utf-8"?> + <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" + "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> + <html> + <head/> + <body>html with dtd</body> + </html>""") + + parser = xmlutils.ProtectedExpatParser(forbid_dtd=True, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) + + def test_external_file(self): + xml_string = """<!DOCTYPE external [ + <!ENTITY ee SYSTEM "file:///PATH/TO/root.xml"> + ]> + <root>ⅇ</root>""" + + parser = xmlutils.ProtectedExpatParser(forbid_dtd=False, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) + + def test_notation(self): + xml_string = """<?xml version="1.0" standalone="no"?> + <!-- comment data --> + <!DOCTYPE x [ + <!NOTATION notation SYSTEM "notation.jpeg"> + ]> + <root attr1="value1"> + </root>""" + + parser = xmlutils.ProtectedExpatParser(forbid_dtd=False, + forbid_entities=True) + self.assertRaises(ValueError, + minidom.parseString, + xml_string, parser) |