You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2017/03/27 11:23:07 UTC
cxf git commit: Adding a test to make sure that XXE declarations are
not processed
Repository: cxf
Updated Branches:
refs/heads/master 10ed38c6d -> 15929d58e
Adding a test to make sure that XXE declarations are not processed
Project: http://git-wip-us.apache.org/repos/asf/cxf/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf/commit/15929d58
Tree: http://git-wip-us.apache.org/repos/asf/cxf/tree/15929d58
Diff: http://git-wip-us.apache.org/repos/asf/cxf/diff/15929d58
Branch: refs/heads/master
Commit: 15929d58e9535701076b6afa13b1b250d6bae157
Parents: 10ed38c
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Mar 27 12:15:10 2017 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Mon Mar 27 12:15:10 2017 +0100
----------------------------------------------------------------------
.../org/apache/cxf/systest/jaxrs/BookStore.java | 7 ++
.../org/apache/cxf/systest/jaxrs/XXETest.java | 54 ++++++++++++++
.../jaxrs/src/test/resources/logging.properties | 74 ++++++++++++++++++++
3 files changed, 135 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf/blob/15929d58/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/BookStore.java
----------------------------------------------------------------------
diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/BookStore.java b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/BookStore.java
index e0423a3..d71473b 100644
--- a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/BookStore.java
+++ b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/BookStore.java
@@ -323,6 +323,13 @@ public class BookStore {
}
@POST
+ @Path("/echoxmlbook")
+ @Produces("application/xml")
+ public Book echoXmlBook(Book book) {
+ return book;
+ }
+
+ @POST
@Path("/emptyform")
@Produces("text/plain")
@Consumes(MediaType.APPLICATION_FORM_URLENCODED)
http://git-wip-us.apache.org/repos/asf/cxf/blob/15929d58/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/XXETest.java
----------------------------------------------------------------------
diff --git a/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/XXETest.java b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/XXETest.java
new file mode 100644
index 0000000..68f7499
--- /dev/null
+++ b/systests/jaxrs/src/test/java/org/apache/cxf/systest/jaxrs/XXETest.java
@@ -0,0 +1,54 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cxf.systest.jaxrs;
+
+import org.apache.cxf.jaxrs.client.WebClient;
+import org.apache.cxf.jaxrs.model.AbstractResourceInfo;
+import org.apache.cxf.testutil.common.AbstractBusClientServerTestBase;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+/**
+ * A test to make sure that DOCTYPE declarations are not allowed
+ */
+public class XXETest extends AbstractBusClientServerTestBase {
+ public static final String PORT = BookServer.PORT;
+
+ @BeforeClass
+ public static void startServers() throws Exception {
+ AbstractResourceInfo.clearAllMaps();
+ assertTrue("server did not launch correctly",
+ launchServer(BookServer.class, true));
+ createStaticBus();
+ }
+
+ @Test
+ public void testEchoXmlBookQuery() throws Exception {
+ String address = "http://localhost:" + PORT + "/bookstore/echoxmlbook";
+
+ WebClient webClient = WebClient.create(address).accept("application/xml");
+ String payload = "<!DOCTYPE requestType [<!ENTITY file SYSTEM \"/etc/hosts\">]>"
+ + "<Book><id>125</id><name>&file;</name></Book>";
+ Book b = webClient.post(payload, Book.class);
+ assertEquals(125L, b.getId());
+ assertEquals("", b.getName());
+ }
+
+}
\ No newline at end of file
http://git-wip-us.apache.org/repos/asf/cxf/blob/15929d58/systests/jaxrs/src/test/resources/logging.properties
----------------------------------------------------------------------
diff --git a/systests/jaxrs/src/test/resources/logging.properties b/systests/jaxrs/src/test/resources/logging.properties
new file mode 100644
index 0000000..b2e5a79
--- /dev/null
+++ b/systests/jaxrs/src/test/resources/logging.properties
@@ -0,0 +1,74 @@
+#
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+#
+############################################################
+# Default Logging Configuration File
+#
+# You can use a different file by specifying a filename
+# with the java.util.logging.config.file system property.
+# For example java -Djava.util.logging.config.file=myfile
+############################################################
+
+############################################################
+# Global properties
+############################################################
+
+# "handlers" specifies a comma separated list of log Handler
+# classes. These handlers will be installed during VM startup.
+# Note that these classes must be on the system classpath.
+# By default we only configure a ConsoleHandler, which will only
+# show messages at the INFO and above levels.
+#handlers= java.util.logging.ConsoleHandler
+
+# To also add the FileHandler, use the following line instead.
+#handlers= java.util.logging.FileHandler, java.util.logging.ConsoleHandler
+
+# Default global logging level.
+# This specifies which kinds of events are logged across
+# all loggers. For any given facility this global level
+# can be overriden by a facility specific level
+# Note that the ConsoleHandler also has a separate level
+# setting to limit messages printed to the console.
+.level= INFO
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+# default file output is in user's home directory.
+java.util.logging.FileHandler.pattern = %h/java%u.log
+java.util.logging.FileHandler.limit = 50000
+java.util.logging.FileHandler.count = 1
+java.util.logging.FileHandler.formatter = java.util.logging.XMLFormatter
+
+# Limit the message that are printed on the console to INFO and above.
+java.util.logging.ConsoleHandler.level = INFO
+java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
+
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+# For example, set the com.xyz.foo logger to only log SEVERE
+# messages:
+#com.xyz.foo.level = SEVERE