提交 ca1cc0e3 编写于 作者: J James Nord

Merge pull request #2261 from rodrigc/xml_test

In testParse_with_XXE(), use more temporary variables
......@@ -120,11 +120,14 @@ public class XMLUtilsTest {
@Test
public void testParse_with_XXE() throws IOException, XPathExpressionException {
try {
Document doc = XMLUtils.parse(new StringReader("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
final String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" +
"<!DOCTYPE foo [\n" +
" <!ELEMENT foo ANY >\n" +
" <!ENTITY xxe SYSTEM \"http://abc.com/temp/test.jsp\" >]> " +
"<foo>&xxe;</foo>"));
"<foo>&xxe;</foo>";
StringReader stringReader = new StringReader(xml);
Document doc = XMLUtils.parse(stringReader);
Assert.fail("Expecting SAXException for XXE.");
} catch (SAXException e) {
assertThat(e.getMessage(), containsString("DOCTYPE is disallowed"));
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册