-
Notifications
You must be signed in to change notification settings - Fork 163
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1819 from hapifhir/do-20241119-xmlutils-tests
Automate testing for XMLUtils factory methods
- Loading branch information
Showing
9 changed files
with
192 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,5 +4,5 @@ | |
| "https://checkstyle.org/dtds/suppressions_1_2.dtd"> | ||
|
|
||
| <suppressions> | ||
|
|
||
| </suppressions> | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
87 changes: 87 additions & 0 deletions
87
org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/xml/XMLUtilTests.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| package org.hl7.fhir.utilities.xml; | ||
|
|
||
| import net.sf.saxon.trans.XPathException; | ||
| import org.hl7.fhir.utilities.filesystem.ManagedFileAccess; | ||
| import org.junit.Test; | ||
| import org.w3c.dom.Document; | ||
| import org.xml.sax.InputSource; | ||
| import org.xml.sax.SAXException; | ||
| import org.xml.sax.SAXParseException; | ||
| import org.xml.sax.XMLReader; | ||
|
|
||
| import javax.xml.parsers.DocumentBuilder; | ||
| import javax.xml.parsers.DocumentBuilderFactory; | ||
| import javax.xml.parsers.ParserConfigurationException; | ||
| import javax.xml.parsers.SAXParserFactory; | ||
| import javax.xml.transform.*; | ||
| import javax.xml.transform.dom.DOMResult; | ||
| import javax.xml.transform.dom.DOMSource; | ||
| import javax.xml.transform.sax.SAXSource; | ||
| import javax.xml.transform.stream.StreamResult; | ||
| import javax.xml.transform.stream.StreamSource; | ||
|
|
||
| import java.io.File; | ||
| import java.io.IOException; | ||
| import java.io.StringWriter; | ||
|
|
||
| import static org.assertj.core.api.Assertions.assertThat; | ||
| import static org.junit.jupiter.api.Assertions.assertThrows; | ||
|
|
||
| public class XMLUtilTests { | ||
| @Test | ||
| public void testDocumentBuilderThrowsExceptionForExternalEntity() throws ParserConfigurationException, IOException { | ||
| DocumentBuilderFactory factory = XMLUtil.newXXEProtectedDocumentBuilderFactory(); | ||
| DocumentBuilder safeBuilder = factory.newDocumentBuilder(); | ||
|
|
||
| File file = ManagedFileAccess.file("src/test/resources/xml/evil-resource.xml"); | ||
|
|
||
| SAXParseException e = assertThrows(SAXParseException.class, ()-> safeBuilder.parse(file)); | ||
| assertThat(e.getMessage()).contains("DOCTYPE is disallowed"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testTransformerFactoryThrowsExceptionForExternalEntity() throws ParserConfigurationException, IOException, SAXException, TransformerException { | ||
| DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance(); | ||
| DocumentBuilder safeBuilder = factory.newDocumentBuilder(); | ||
|
|
||
| File file = ManagedFileAccess.file("src/test/resources/xml/resource.xml"); | ||
|
|
||
| Document document = safeBuilder.parse(file); | ||
|
|
||
| StringWriter sw = new StringWriter(); | ||
| TransformerFactory tf = XMLUtil.newXXEProtectedTransformerFactory(); | ||
|
|
||
| File templateFile = ManagedFileAccess.file("src/test/resources/xml/evil-transform.xslt"); | ||
| Source xsltSource = new StreamSource(templateFile); | ||
| Transformer transformer = tf.newTransformer(xsltSource); | ||
| transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "no"); | ||
| transformer.setOutputProperty(OutputKeys.METHOD, "xml"); | ||
| transformer.setOutputProperty(OutputKeys.INDENT, "yes"); | ||
| transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); | ||
|
|
||
| XPathException e = assertThrows(XPathException.class, () -> transformer.transform(new DOMSource(document), new StreamResult(sw))); | ||
| assertThat(e.getMessage()).contains("URIs using protocol file are not permitted"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testSaxParserFactoryThrowsExceptionForExternalEntity() throws ParserConfigurationException, IOException, SAXException, TransformerException { | ||
|
|
||
| SAXParserFactory spf = XMLUtil.newXXEProtectedSaxParserFactory(); | ||
| spf.setNamespaceAware(true); | ||
| spf.setValidating(false); | ||
| XMLReader xmlReader = spf.newSAXParser().getXMLReader(); | ||
|
|
||
| File templateFile = ManagedFileAccess.file("src/test/resources/xml/evil-resource.xml"); | ||
|
|
||
| SAXParseException e = assertThrows(SAXParseException.class, () -> xmlReader.parse(new StreamSource(templateFile).getSystemId())); | ||
| assertThat(e.getMessage()).contains("DOCTYPE is disallowed"); | ||
| } | ||
|
|
||
| @Test | ||
| public void testXMLReaderThrowsExceptionForExternalEntity() throws ParserConfigurationException, IOException, SAXException, TransformerException { | ||
| SAXParserFactory spf = SAXParserFactory.newInstance(); | ||
|
|
||
| IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () -> XMLUtil.getXXEProtectedXMLReader(spf)); | ||
| assertThat(e.getMessage()).contains("SAXParserFactory has insecure feature setting"); | ||
| } | ||
| } |
6 changes: 6 additions & 0 deletions
6
org.hl7.fhir.utilities/src/test/resources/xml/evil-resource.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!DOCTYPE foo [<!ENTITY example SYSTEM "jackpot.xml"> ]> | ||
| <Patient xmlns="http://hl7.org/fhir"> | ||
| <id value="example"/> | ||
| <text> <status value="generated"/> &example;</text> | ||
| </Patient> |
6 changes: 6 additions & 0 deletions
6
org.hl7.fhir.utilities/src/test/resources/xml/evil-transform.xslt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| <xsl:stylesheet version="1.0" | ||
| xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> | ||
| <xsl:template match="/"> | ||
| Evil: <xsl:value-of select="document('jackpot.xml')" /> | ||
| </xsl:template> | ||
| </xsl:stylesheet> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| <stuff>stuff</stuff> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
|
|
||
| <Patient xmlns="http://hl7.org/fhir"> | ||
| <id value="example"/> | ||
| </Patient> |