From 57e712c98b285be4d286fd55a53984d4035fcb65 Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Fri, 14 Jul 2023 22:26:20 +0900 Subject: [PATCH] t/35huge_mode.t: fix test with libxml2 2.11 libxml 2.11 made improved parsing enough to not fail our test: --- Protection against entity expansion attacks, also known as "billion laughs" has been greatly improved. Malicious files should be detected reliably now and false positives should be reduced. It is possible though that large documents which make heavy use of entities are rejected now. --- Adjusts the test to have greater depth and fix exception message which changed a bit; the new exception is as follow: Entity: line 1: parser error : Maximum entity nesting depth exceeded &ha8; &ha8; Fixes: #79 --- t/35huge_mode.t | 65 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 51 insertions(+), 14 deletions(-) diff --git a/t/35huge_mode.t b/t/35huge_mode.t index 1ccb334b..c25be3df 100644 --- a/t/35huge_mode.t +++ b/t/35huge_mode.t @@ -29,20 +29,57 @@ my $benign_xml = <<'EOF'; EOF my $evil_xml = <<'EOF'; - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]> -&lol9; +&ha48; EOF my($parser, $doc); @@ -57,7 +94,7 @@ $doc = eval { $parser->parse_string($evil_xml); }; # TEST isnt("$@", "", "exception thrown during parse"); # TEST -like($@, qr/entity.*loop/si, "exception refers to entity reference loop"); +like($@, qr/entity/si, "exception refers to entity maximum loop (libxml2 <= 2.10) or depth (>= 2.11)"); $parser = XML::LibXML->new;