diff options
| author | Haelwenn <contact+git.pleroma.social@hacktivis.me> | 2023-08-05 08:12:25 +0000 |
|---|---|---|
| committer | Haelwenn <contact+git.pleroma.social@hacktivis.me> | 2023-08-05 08:12:25 +0000 |
| commit | 1f4be2b3495b6df03843f923a53aff5913e1ef0d (patch) | |
| tree | 55a72082c7776290cdbbbd16fbf043f9c6fc4bb5 /test | |
| parent | ff2f3862abd4a9eabc0440999337a2d44c8b797e (diff) | |
| parent | b631180b38ac63029f08bef137b13231bcf57b59 (diff) | |
| download | pleroma-1f4be2b3495b6df03843f923a53aff5913e1ef0d.tar.gz pleroma-1f4be2b3495b6df03843f923a53aff5913e1ef0d.zip | |
Merge branch 'releases/2.5.4' into 'stable'
Release 2.5.4
See merge request pleroma/pleroma!3929
Diffstat (limited to 'test')
| -rw-r--r-- | test/fixtures/xml_external_entities.xml | 3 | ||||
| -rw-r--r-- | test/pleroma/web/web_finger_test.exs | 23 | ||||
| -rw-r--r-- | test/pleroma/web/xml_test.exs | 10 |
3 files changed, 36 insertions, 0 deletions
diff --git a/test/fixtures/xml_external_entities.xml b/test/fixtures/xml_external_entities.xml new file mode 100644 index 000000000..d5ff87134 --- /dev/null +++ b/test/fixtures/xml_external_entities.xml @@ -0,0 +1,3 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> +<stockCheck><productId>&xxe;</productId></stockCheck> diff --git a/test/pleroma/web/web_finger_test.exs b/test/pleroma/web/web_finger_test.exs index fafef54fe..be5e08776 100644 --- a/test/pleroma/web/web_finger_test.exs +++ b/test/pleroma/web/web_finger_test.exs @@ -180,5 +180,28 @@ defmodule Pleroma.Web.WebFingerTest do {:ok, _data} = WebFinger.finger("pekorino@pawoo.net") end + + test "refuses to process XML remote entities" do + Tesla.Mock.mock(fn + %{ + url: "https://pawoo.net/.well-known/webfinger?resource=acct:pekorino@pawoo.net" + } -> + {:ok, + %Tesla.Env{ + status: 200, + body: File.read!("test/fixtures/xml_external_entities.xml"), + headers: [{"content-type", "application/xrd+xml"}] + }} + + %{url: "https://pawoo.net/.well-known/host-meta"} -> + {:ok, + %Tesla.Env{ + status: 200, + body: File.read!("test/fixtures/tesla_mock/pawoo.net_host_meta") + }} + end) + + assert :error = WebFinger.finger("pekorino@pawoo.net") + end end end diff --git a/test/pleroma/web/xml_test.exs b/test/pleroma/web/xml_test.exs new file mode 100644 index 000000000..89d4709b6 --- /dev/null +++ b/test/pleroma/web/xml_test.exs @@ -0,0 +1,10 @@ +defmodule Pleroma.Web.XMLTest do + use Pleroma.DataCase, async: true + + alias Pleroma.Web.XML + + test "refuses to load external entities from XML" do + data = File.read!("test/fixtures/xml_external_entities.xml") + assert(:error == XML.parse_document(data)) + end +end |