diff options
author | Frédéric Guillot <fred@kanboard.net> | 2018-02-02 15:39:47 -0800 |
---|---|---|
committer | Frédéric Guillot <fred@kanboard.net> | 2018-02-02 15:39:47 -0800 |
commit | bab2fb3899cc243e2f67ccf787f3657b250f6e61 (patch) | |
tree | 07ddb755330b320fbd2e2803fdb978cfff3bd452 /vendor/zendframework/zendxml/tests/ZendXmlTest | |
parent | 5c4d06d26b808ea50d08f83ae02ac82373fd2208 (diff) |
Remove dependency on PicoFeed
Diffstat (limited to 'vendor/zendframework/zendxml/tests/ZendXmlTest')
-rw-r--r-- | vendor/zendframework/zendxml/tests/ZendXmlTest/MultibyteTest.php | 125 | ||||
-rw-r--r-- | vendor/zendframework/zendxml/tests/ZendXmlTest/SecurityTest.php | 135 |
2 files changed, 0 insertions, 260 deletions
diff --git a/vendor/zendframework/zendxml/tests/ZendXmlTest/MultibyteTest.php b/vendor/zendframework/zendxml/tests/ZendXmlTest/MultibyteTest.php deleted file mode 100644 index 165e8fa5..00000000 --- a/vendor/zendframework/zendxml/tests/ZendXmlTest/MultibyteTest.php +++ /dev/null @@ -1,125 +0,0 @@ -<?php -/** - * Zend Framework (http://framework.zend.com/) - * - * @link http://github.com/zendframework/zf2 for the canonical source repository - * @copyright Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com) - * @license http://framework.zend.com/license/new-bsd New BSD License - */ -namespace ZendTest\Xml; - -use ZendXml\Security as XmlSecurity; -use ZendXml\Exception; -use DOMDocument; -use ReflectionMethod; -use SimpleXMLElement; - -/** - * @group ZF2015-06 - */ -class MultibyteTest extends \PHPUnit_Framework_TestCase -{ - public function multibyteEncodings() - { - return array( - 'UTF-16LE' => array('UTF-16LE', pack('CC', 0xff, 0xfe), 3), - 'UTF-16BE' => array('UTF-16BE', pack('CC', 0xfe, 0xff), 3), - 'UTF-32LE' => array('UTF-32LE', pack('CCCC', 0xff, 0xfe, 0x00, 0x00), 4), - 'UTF-32BE' => array('UTF-32BE', pack('CCCC', 0x00, 0x00, 0xfe, 0xff), 4), - ); - } - - public function getXmlWithXXE() - { - return <<<XML -<?xml version="1.0" encoding="{ENCODING}"?> -<!DOCTYPE methodCall [ - <!ENTITY pocdata SYSTEM "file:///etc/passwd"> -]> -<methodCall> - <methodName>retrieved: &pocdata;</methodName> -</methodCall> -XML; - } - - /** - * Invoke ZendXml\Security::heuristicScan with the provided XML. - * - * @param string $xml - * @return void - * @throws Exception\RuntimeException - */ - public function invokeHeuristicScan($xml) - { - $r = new ReflectionMethod('ZendXml\Security', 'heuristicScan'); - $r->setAccessible(true); - return $r->invoke(null, $xml); - } - - /** - * @dataProvider multibyteEncodings - * @group heuristicDetection - */ - public function testDetectsMultibyteXXEVectorsUnderFPMWithEncodedStringMissingBOM($encoding, $bom, $bomLength) - { - $xml = $this->getXmlWithXXE(); - $xml = str_replace('{ENCODING}', $encoding, $xml); - $xml = iconv('UTF-8', $encoding, $xml); - $this->assertNotSame(0, strncmp($xml, $bom, $bomLength)); - $this->setExpectedException('ZendXml\Exception\RuntimeException', 'ENTITY'); - $this->invokeHeuristicScan($xml); - } - - /** - * @dataProvider multibyteEncodings - */ - public function testDetectsMultibyteXXEVectorsUnderFPMWithEncodedStringUsingBOM($encoding, $bom) - { - $xml = $this->getXmlWithXXE(); - $xml = str_replace('{ENCODING}', $encoding, $xml); - $orig = iconv('UTF-8', $encoding, $xml); - $xml = $bom . $orig; - $this->setExpectedException('ZendXml\Exception\RuntimeException', 'ENTITY'); - $this->invokeHeuristicScan($xml); - } - - public function getXmlWithoutXXE() - { - return <<<XML -<?xml version="1.0" encoding="{ENCODING}"?> -<methodCall> - <methodName>retrieved: &pocdata;</methodName> -</methodCall> -XML; - } - - /** - * @dataProvider multibyteEncodings - */ - public function testDoesNotFlagValidMultibyteXmlAsInvalidUnderFPM($encoding) - { - $xml = $this->getXmlWithoutXXE(); - $xml = str_replace('{ENCODING}', $encoding, $xml); - $xml = iconv('UTF-8', $encoding, $xml); - try { - $result = $this->invokeHeuristicScan($xml); - $this->assertNull($result); - } catch (\Exception $e) { - $this->fail('Security scan raised exception when it should not have'); - } - } - - /** - * @dataProvider multibyteEncodings - * @group mixedEncoding - */ - public function testDetectsXXEWhenXMLDocumentEncodingDiffersFromFileEncoding($encoding, $bom) - { - $xml = $this->getXmlWithXXE(); - $xml = str_replace('{ENCODING}', 'UTF-8', $xml); - $xml = iconv('UTF-8', $encoding, $xml); - $xml = $bom . $xml; - $this->setExpectedException('ZendXml\Exception\RuntimeException', 'ENTITY'); - $this->invokeHeuristicScan($xml); - } -} diff --git a/vendor/zendframework/zendxml/tests/ZendXmlTest/SecurityTest.php b/vendor/zendframework/zendxml/tests/ZendXmlTest/SecurityTest.php deleted file mode 100644 index fa3b30bf..00000000 --- a/vendor/zendframework/zendxml/tests/ZendXmlTest/SecurityTest.php +++ /dev/null @@ -1,135 +0,0 @@ -<?php -/** - * Zend Framework (http://framework.zend.com/) - * - * @link http://github.com/zendframework/zf2 for the canonical source repository - * @copyright Copyright (c) 2005-2013 Zend Technologies USA Inc. (http://www.zend.com) - * @license http://framework.zend.com/license/new-bsd New BSD License - */ -namespace ZendTest\Xml; - -use ZendXml\Security as XmlSecurity; -use ZendXml\Exception; -use DOMDocument; -use SimpleXMLElement; - -class SecurityTest extends \PHPUnit_Framework_TestCase -{ - /** - * @expectedException ZendXml\Exception\RuntimeException - */ - public function testScanForXEE() - { - $xml = <<<XML -<?xml version="1.0"?> -<!DOCTYPE results [<!ENTITY harmless "completely harmless">]> -<results> - <result>This result is &harmless;</result> -</results> -XML; - - $this->setExpectedException('ZendXml\Exception\RuntimeException'); - $result = XmlSecurity::scan($xml); - } - - public function testScanForXXE() - { - $file = tempnam(sys_get_temp_dir(), 'ZendXml_Security'); - file_put_contents($file, 'This is a remote content!'); - $xml = <<<XML -<?xml version="1.0"?> -<!DOCTYPE root -[ -<!ENTITY foo SYSTEM "file://$file"> -]> -<results> - <result>&foo;</result> -</results> -XML; - - try { - $result = XmlSecurity::scan($xml); - } catch (Exception\RuntimeException $e) { - unlink($file); - return; - } - $this->fail('An expected exception has not been raised.'); - } - - public function testScanSimpleXmlResult() - { - $result = XmlSecurity::scan($this->getXml()); - $this->assertTrue($result instanceof SimpleXMLElement); - $this->assertEquals($result->result, 'test'); - } - - public function testScanDom() - { - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($this->getXml(), $dom); - $this->assertTrue($result instanceof DOMDocument); - $node = $result->getElementsByTagName('result')->item(0); - $this->assertEquals($node->nodeValue, 'test'); - } - - public function testScanInvalidXml() - { - $xml = <<<XML -<foo>test</bar> -XML; - - $result = XmlSecurity::scan($xml); - $this->assertFalse($result); - } - - public function testScanInvalidXmlDom() - { - $xml = <<<XML -<foo>test</bar> -XML; - - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($xml, $dom); - $this->assertFalse($result); - } - - public function testScanFile() - { - $file = tempnam(sys_get_temp_dir(), 'ZendXml_Security'); - file_put_contents($file, $this->getXml()); - - $result = XmlSecurity::scanFile($file); - $this->assertTrue($result instanceof SimpleXMLElement); - $this->assertEquals($result->result, 'test'); - unlink($file); - } - - public function testScanXmlWithDTD() - { - $xml = <<<XML -<?xml version="1.0"?> -<!DOCTYPE results [ -<!ELEMENT results (result+)> -<!ELEMENT result (#PCDATA)> -]> -<results> - <result>test</result> -</results> -XML; - - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($xml, $dom); - $this->assertTrue($result instanceof DOMDocument); - $this->assertTrue($result->validate()); - } - - protected function getXml() - { - return <<<XML -<?xml version="1.0"?> -<results> - <result>test</result> -</results> -XML; - } -} |