From cfb54fcf1aeb3121b36fa935945e9c53e273ca9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Tue, 1 Sep 2026 22:05:56 -0300
Subject: [PATCH] test(xcatd): assert the outcome of an external entity, not
 the route

The test required the parser to parse a payload that names an external entity
and to leave the system identifier of that entity in the document. That is one
way to keep the contents of the named file out of the document, and it is the
way the parser behaves today, but it is not the contract. The contract is that
the contents never arrive.

Assert that instead: the contents reach neither the document nor the error. A
parser that refuses the payload keeps the contract as well as a parser that
parses it and leaves the entity alone.

Behaviour does not change. The test passes against this branch and against the
current parser.
---
 xCAT-test/unit/xml_external_entity.t | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/xCAT-test/unit/xml_external_entity.t b/xCAT-test/unit/xml_external_entity.t
index 02f68605c..cff387e14 100644
--- a/xCAT-test/unit/xml_external_entity.t
+++ b/xCAT-test/unit/xml_external_entity.t
@@ -38,23 +38,23 @@ sub parsed_tree {
     return ($tree, $@);
 }
 
-# A parser path must parse the payload, replace the external entity with its
-# system identifier, and never read the file contents.
+# The contract this file guards is that the contents of the file an external
+# entity names never reach the parsed document. A parser path may deliver that
+# either by parsing the payload and leaving the entity unresolved, or by
+# refusing the payload. Assert the outcome, not the route.
 sub check_path {
     my ($label) = @_;
     my ($tree, $error) = parsed_tree();
-    is($error, '', "$label: the payload parses without error");
-    ok(defined($tree), "$label: the parser returns a tree");
     my $dump = defined($tree) ? Data::Dumper::Dumper($tree) : '';
-    like($dump, qr{\Q$secret_path\E},
-        "$label: the external entity is replaced by its system identifier");
     unlike($dump, qr/SECRET-CONTENT-DO-NOT-LEAK/,
         "$label: the external entity content is not read");
+    unlike($error, qr/SECRET-CONTENT-DO-NOT-LEAK/,
+        "$label: the external entity content does not reach the error either");
 }
 
 # The modern path: XML::Simple with new_xml_parser.
 SKIP: {
-    skip 'XML::Simple lacks new_xml_parser on this system', 4
+    skip 'XML::Simple lacks new_xml_parser on this system', 2
         unless exists &{'XML::Simple::new_xml_parser'};
     check_path('modern path');
 }