xCAT/xcat-core
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-core.git synced 2026-09-04 20:17:55 +00:00
Code Issues Releases Wiki Activity

test(xcatd): assert the outcome of an external entity, not the route

Browse Source 
The test required the parser to parse a payload that names an external entity
and to leave the system identifier of that entity in the document. That is one
way to keep the contents of the named file out of the document, and it is the
way the parser behaves today, but it is not the contract. The contract is that
the contents never arrive.

Assert that instead: the contents reach neither the document nor the error. A
parser that refuses the payload keeps the contract as well as a parser that
parses it and leaves the entity alone.

Behaviour does not change. The test passes against this branch and against the
current parser.
This commit is contained in:
Vinícius Ferrão
2026-09-01 22:05:56 -03:00
parent 7759714c5a
commit cfb54fcf1a
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xCAT-test/unit/xml_external_entity.t
+7 -7
View File
@@ -38,23 +38,23 @@ sub parsed_tree {
return ($tree, $@);
}
# A parser path must parse the payload, replace the external entity with its
# system identifier, and never read the file contents.
# The contract this file guards is that the contents of the file an external
# entity names never reach the parsed document. A parser path may deliver that
# either by parsing the payload and leaving the entity unresolved, or by
# refusing the payload. Assert the outcome, not the route.
sub check_path {
my ($label) = @_;
my ($tree, $error) = parsed_tree();
is($error, '', "$label: the payload parses without error");
ok(defined($tree), "$label: the parser returns a tree");
my $dump = defined($tree) ? Data::Dumper::Dumper($tree) : '';
like($dump, qr{\Q$secret_path\E},
"$label: the external entity is replaced by its system identifier");
unlike($dump, qr/SECRET-CONTENT-DO-NOT-LEAK/,
"$label: the external entity content is not read");
unlike($error, qr/SECRET-CONTENT-DO-NOT-LEAK/,
"$label: the external entity content does not reach the error either");
}
# The modern path: XML::Simple with new_xml_parser.
SKIP: {
skip 'XML::Simple lacks new_xml_parser on this system', 4
skip 'XML::Simple lacks new_xml_parser on this system', 2
unless exists &{'XML::Simple::new_xml_parser'};
check_path('modern path');
}