Fix #43

nextcloud · Jun 22, 2016 · 588a169 · 588a169
1 parent 0535015
commit 588a169
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/nextcloudappstore/core/api/v1/tests/data/infoxmls/entities.xml b/nextcloudappstore/core/api/v1/tests/data/infoxmls/entities.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<!DOCTYPE author [
+    <!ELEMENT name (#PCDATA)>
+    <!ENTITY js "Jo Smith">
+]>
+<info>
+    <id>news</id>
+    <name>News &js;</name>
+    <description>An RSS/Atom feed reader</description>
+    <version>8.8.2</version>
+    <licence>agpl</licence>
+    <author>Bernhard Posselt</author>
+    <category>multimedia</category>
+    <dependencies>
+        <owncloud min-version="9.0"/>
+    </dependencies>
+</info>
diff --git a/nextcloudappstore/core/api/v1/tests/test_parser.py b/nextcloudappstore/core/api/v1/tests/test_parser.py
@@ -65,6 +65,13 @@ def test_broken_xml(self):
                                self.config.pre_info_xslt,
                                self.config.info_xslt)
 
+    def test_entities(self):
+        xml = self._get_test_xml('data/infoxmls/entities.xml')
+        with (self.assertRaises(InvalidAppMetadataXmlException)):
+            parse_app_metadata(xml, self.config.info_schema,
+                               self.config.pre_info_xslt,
+                               self.config.info_xslt)
+
     def test_extract_gunzip_info(self):
         path = self.get_path('data/archives/full.tar.gz')
         extractor = GunZipAppMetadataExtractor(self.config)