This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-xml.git
commit 65c5443c606c2128bda4edd31db2328e4e996ded Author: Gary Gregory <[email protected]> AuthorDate: Fri Aug 28 14:47:58 2026 -0400 Rename test methods. --- .../commons/xml/AssociatedStylesheetTest.java | 6 +++--- .../commons/xml/EntityResolverFloorTest.java | 22 +++++++++++----------- .../apache/commons/xml/SaxSurfaceTestSupport.java | 2 +- .../commons/xml/SaxonXPathExternalCallsTest.java | 8 ++++---- .../commons/xml/SchemaLocationPropertyTest.java | 12 ++++++------ .../apache/commons/xml/TemplatesHandlerTest.java | 4 ++-- .../apache/commons/xml/TransformerHandlerTest.java | 6 +++--- .../java/org/apache/commons/xml/XMLFilterTest.java | 6 +++--- 8 files changed, 33 insertions(+), 33 deletions(-) diff --git a/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java b/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java index 27e5411..3936db1 100644 --- a/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java +++ b/src/test/java/org/apache/commons/xml/AssociatedStylesheetTest.java @@ -49,7 +49,7 @@ private static void assertAssociatedStylesheet(final Source associated) { } } - private static TransformerFactory hardenedFactory() { + private static TransformerFactory secureFactory() { final TransformerFactory factory = SecureTransformerFactory.newInstance(); factory.setErrorListener(AttackTestSupport.STRICT_REPORTER); return factory; @@ -60,7 +60,7 @@ void secureGetAssociatedStylesheetIgnoresExternalDtd() throws TransformerConfigu // The prolog declares an unreachable external DTD; the secure parse resolves it to empty rather than fetching it, so the PI scan completes and finds // the stylesheet instead of throwing on a fetch. (The returned Source's shape is engine-specific: XSLTC and Xalan point it at included.xsl, while Saxon // resolves the href through its own floor and returns an empty source; both mean the scan ran without fetching the DTD.) - final Source associated = hardenedFactory() + final Source associated = secureFactory() .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet.xml"), null, null, null); assertAssociatedStylesheet(associated); } @@ -68,7 +68,7 @@ void secureGetAssociatedStylesheetIgnoresExternalDtd() throws TransformerConfigu @Test void secureGetAssociatedStylesheetReturnsStylesheet() throws TransformerConfigurationException { // Positive control: a plain document with no DOCTYPE resolves its xml-stylesheet PI end to end. - final Source associated = hardenedFactory() + final Source associated = secureFactory() .getAssociatedStylesheet(AttackTestSupport.resourceSource("associated-stylesheet-plain.xml"), null, null, null); assertAssociatedStylesheet(associated); } diff --git a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java index cec3f4a..de46bc9 100644 --- a/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java +++ b/src/test/java/org/apache/commons/xml/EntityResolverFloorTest.java @@ -125,13 +125,13 @@ private static XMLInputFactory externalEntityStaxFactory() { return factory; } - private static DocumentBuilder hardenedBuilder() throws Exception { + private static DocumentBuilder secureBuilder() throws Exception { final DocumentBuilder builder = SecureDocumentBuilderFactory.newInstance().newDocumentBuilder(); builder.setErrorHandler(AttackTestSupport.STRICT_REPORTER); return builder; } - private static XMLReader hardenedReader() throws Exception { + private static XMLReader secureXMLReader() throws Exception { final XMLReader reader = SecureSAXParserFactory.newInstance().newSAXParser().getXMLReader(); reader.setErrorHandler(AttackTestSupport.STRICT_REPORTER); return reader; @@ -143,7 +143,7 @@ private static XMLReader hardenedReader() throws Exception { * resolver that returns {@code null} cannot re-open the fetch. The strict listener turns any reported-and-recovered error into a test failure, so an * implementation cannot quietly recover from a floor resolution while the test asserts clean completion. */ - private static TransformerFactory hardenedTransformerFactory() { + private static TransformerFactory secureTransformerFactory() { final TransformerFactory factory = SecureTransformerFactory.newInstance(); factory.setErrorListener(AttackTestSupport.STRICT_REPORTER); return factory; @@ -189,7 +189,7 @@ private static XMLReader xIncludeAwareReader() throws Exception { @Tag("dom") void domDoesNotLeakUnlisted() throws Exception { Assumptions.assumeTrue(AttackTestSupport.DOM_RESOLVES_INTERNAL_ENTITIES, "platform DOM does not resolve user-defined entities"); - final DocumentBuilder builder = hardenedBuilder(); + final DocumentBuilder builder = secureBuilder(); builder.setEntityResolver(ENTITY_ALLOW_LIST); // The caller returns null for the unlisted entity, so the floor resolves it to empty rather than fetching it: the parse completes (or is rejected) // without leaking the entity's content. @@ -205,7 +205,7 @@ void domDoesNotLeakUnlisted() throws Exception { @Tag("dom") void domResolvesAllowListed() throws Exception { Assumptions.assumeTrue(AttackTestSupport.DOM_RESOLVES_INTERNAL_ENTITIES, "platform DOM does not resolve user-defined entities"); - final DocumentBuilder builder = hardenedBuilder(); + final DocumentBuilder builder = secureBuilder(); builder.setEntityResolver(ENTITY_ALLOW_LIST); final Document doc = builder.parse(AttackTestSupport.inputSource(entityPayload(ALLOWED))); assertTrue(doc.getDocumentElement().getTextContent().contains(AttackTestSupport.LEAKED_MARKER), @@ -240,7 +240,7 @@ void saxParseWithHandlerDoesNotBypass() throws Exception { @Test @Tag("sax") void saxReaderDoesNotLeakUnlisted() throws Exception { - final XMLReader reader = hardenedReader(); + final XMLReader reader = secureXMLReader(); reader.setEntityResolver(ENTITY_ALLOW_LIST); // The caller returns null for the unlisted entity, so the floor resolves it to empty rather than fetching it. final String text; @@ -255,7 +255,7 @@ void saxReaderDoesNotLeakUnlisted() throws Exception { @Test @Tag("sax") void saxReaderResolvesAllowListed() throws Exception { - final XMLReader reader = hardenedReader(); + final XMLReader reader = secureXMLReader(); reader.setEntityResolver(ENTITY_ALLOW_LIST); final String text = AttackTestSupport.captureCharacters(reader, entityPayload(ALLOWED)); assertTrue(text.contains(AttackTestSupport.LEAKED_MARKER), @@ -354,7 +354,7 @@ void staxResolvesAllowListed() throws Exception { @Test @Tag("trax") void transformerDoesNotLeakUnlisted() { - final TransformerFactory factory = hardenedTransformerFactory(); + final TransformerFactory factory = secureTransformerFactory(); factory.setURIResolver((href, base) -> null); // Deterministic on every implementation: XSLTC and Xalan compile the empty document the URIResolver floor // returns, Saxon the EmptySource its Configuration floor returns, so the import contributes nothing. @@ -368,7 +368,7 @@ void transformerDoesNotLeakUnlisted() { @Tag("trax") void transformerParsesOptedInDocumentSecured() { // Same contract on the runtime document() channel, which reaches a different internal reader than the compile-time import. - final TransformerFactory factory = hardenedTransformerFactory(); + final TransformerFactory factory = secureTransformerFactory(); factory.setURIResolver((href, base) -> href != null && href.endsWith("referenced.xml") ? AttackTestSupport.resourceSource("referenced-with-entity.xml") : null); // Same undeclared-entity outcome as the import above: skipped, never expanded. @@ -382,7 +382,7 @@ void transformerParsesOptedInDocumentSecured() { @Tag("trax") void transformerParsesOptedInImportSecured() { // The opted-in module carries an external DTD reference; parsed on the floor the DTD is empty, so its entity cannot expand into the output. - final TransformerFactory factory = hardenedTransformerFactory(); + final TransformerFactory factory = secureTransformerFactory(); factory.setURIResolver((href, base) -> href != null && href.endsWith("included.xsl") ? AttackTestSupport.resourceSource("included-with-entity.xsl") : null); // The emptied DTD leaves the entity undeclared — only a validity violation when an external subset is @@ -397,7 +397,7 @@ void transformerParsesOptedInImportSecured() { @Tag("trax") void transformerResolvesAllowListed() { // with-import.xsl imports included.xsl, so it compiles only if the import is resolved. - final TransformerFactory factory = hardenedTransformerFactory(); + final TransformerFactory factory = secureTransformerFactory(); factory.setURIResolver(XSL_ALLOW_LIST); assertParseSucceeds(() -> factory.newTemplates(AttackTestSupport.resourceSource("with-import.xsl")), "Stylesheet import via caller resolver"); } diff --git a/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java b/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java index 23eb7f2..4dc42f9 100644 --- a/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java +++ b/src/test/java/org/apache/commons/xml/SaxSurfaceTestSupport.java @@ -48,7 +48,7 @@ static void feed(final ContentHandler handler, final InputSource input) throws E } /** The secure factory, as its runtime {@link SAXTransformerFactory} type. */ - static SAXTransformerFactory hardenedFactory() { + static SAXTransformerFactory secureFactory() { return (SAXTransformerFactory) SecureTransformerFactory.newInstance(); } diff --git a/src/test/java/org/apache/commons/xml/SaxonXPathExternalCallsTest.java b/src/test/java/org/apache/commons/xml/SaxonXPathExternalCallsTest.java index 029d450..c2be9ad 100644 --- a/src/test/java/org/apache/commons/xml/SaxonXPathExternalCallsTest.java +++ b/src/test/java/org/apache/commons/xml/SaxonXPathExternalCallsTest.java @@ -89,7 +89,7 @@ private static String evaluateAsString(final XPathFactory factory, final String DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument()); } - private static XPathFactory hardenedSaxonXPathFactory() { + private static XPathFactory secureSaxonXPathFactory() { return SaxonProvider.configure(saxonXPathFactory()); } @@ -117,17 +117,17 @@ private static String unparsedTextExpression() { @Test void secureXPathBlocksDoc() { - assertCallExcludesMarker(hardenedSaxonXPathFactory(), docExpression()); + assertCallExcludesMarker(secureSaxonXPathFactory(), docExpression()); } @Test void secureXPathBlocksJsonDoc() { - assertCallExcludesMarker(hardenedSaxonXPathFactory(), jsonDocExpression()); + assertCallExcludesMarker(secureSaxonXPathFactory(), jsonDocExpression()); } @Test void secureXPathBlocksUnparsedText() { - assertCallExcludesMarker(hardenedSaxonXPathFactory(), unparsedTextExpression()); + assertCallExcludesMarker(secureSaxonXPathFactory(), unparsedTextExpression()); } @Test diff --git a/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java b/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java index b382027..2d8400d 100644 --- a/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java +++ b/src/test/java/org/apache/commons/xml/SchemaLocationPropertyTest.java @@ -80,7 +80,7 @@ private static <T> T configureOrSkip(final ThrowingSupplier<T> setup) { } } - private static DocumentBuilder hardenedValidatingDom(final String property, final String value) { + private static DocumentBuilder secureValidatingDom(final String property, final String value) { return configureOrSkip(() -> { final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); factory.setNamespaceAware(true); @@ -91,7 +91,7 @@ private static DocumentBuilder hardenedValidatingDom(final String property, fina }); } - private static XMLReader hardenedValidatingSax(final String property, final String value) { + private static XMLReader secureValidatingSax(final String property, final String value) { return configureOrSkip(() -> { final SAXParserFactory factory = SecureSAXParserFactory.newInstance(); factory.setNamespaceAware(true); @@ -139,25 +139,25 @@ private static XMLReader permissiveValidatingSax(final String property, final St @Test void secureDomRefusesNoNamespaceSchemaLocation() { - final DocumentBuilder builder = hardenedValidatingDom(EXTERNAL_NO_NS, noNamespaceLocation()); + final DocumentBuilder builder = secureValidatingDom(EXTERNAL_NO_NS, noNamespaceLocation()); assertParseFails(() -> builder.parse(inputSource(NO_NS_INSTANCE)), "DOM external-noNamespaceSchemaLocation", SAXException.class); } @Test void secureDomRefusesSchemaLocation() { - final DocumentBuilder builder = hardenedValidatingDom(EXTERNAL_SCHEMA_LOCATION, namespacedLocation()); + final DocumentBuilder builder = secureValidatingDom(EXTERNAL_SCHEMA_LOCATION, namespacedLocation()); assertParseFails(() -> builder.parse(inputSource(NAMESPACED_INSTANCE)), "DOM external-schemaLocation", SAXException.class); } @Test void secureSaxRefusesNoNamespaceSchemaLocation() { - final XMLReader reader = hardenedValidatingSax(EXTERNAL_NO_NS, noNamespaceLocation()); + final XMLReader reader = secureValidatingSax(EXTERNAL_NO_NS, noNamespaceLocation()); assertParseFails(() -> reader.parse(inputSource(NO_NS_INSTANCE)), "SAX external-noNamespaceSchemaLocation", SAXException.class); } @Test void secureSaxRefusesSchemaLocation() { - final XMLReader reader = hardenedValidatingSax(EXTERNAL_SCHEMA_LOCATION, namespacedLocation()); + final XMLReader reader = secureValidatingSax(EXTERNAL_SCHEMA_LOCATION, namespacedLocation()); assertParseFails(() -> reader.parse(inputSource(NAMESPACED_INSTANCE)), "SAX external-schemaLocation", SAXException.class); } diff --git a/src/test/java/org/apache/commons/xml/TemplatesHandlerTest.java b/src/test/java/org/apache/commons/xml/TemplatesHandlerTest.java index 2972dd9..0a42842 100644 --- a/src/test/java/org/apache/commons/xml/TemplatesHandlerTest.java +++ b/src/test/java/org/apache/commons/xml/TemplatesHandlerTest.java @@ -56,14 +56,14 @@ private static String compileAndTransform(final TemplatesHandler handler, final @Test void secureTemplatesHandlerDoesNotLeakDocument() throws Exception { // The f004 product path: the Templates from getTemplates() must produce floored Transformers for runtime document(). - final TemplatesHandler handler = SaxSurfaceTestSupport.hardenedFactory().newTemplatesHandler(); + final TemplatesHandler handler = SaxSurfaceTestSupport.secureFactory().newTemplatesHandler(); assertFalse(compileAndTransform(handler, "with-document.xsl").contains(AttackTestSupport.LEAKED_MARKER), "document() through TemplatesHandler.getTemplates() leaked"); } @Test void secureTemplatesHandlerDoesNotLeakInclude() throws Exception { - final TemplatesHandler handler = SaxSurfaceTestSupport.hardenedFactory().newTemplatesHandler(); + final TemplatesHandler handler = SaxSurfaceTestSupport.secureFactory().newTemplatesHandler(); assertFalse(compileAndTransform(handler, "with-include.xsl").contains(AttackTestSupport.LEAKED_MARKER), "xsl:include through TemplatesHandler leaked"); } diff --git a/src/test/java/org/apache/commons/xml/TransformerHandlerTest.java b/src/test/java/org/apache/commons/xml/TransformerHandlerTest.java index 060c2fd..9161b07 100644 --- a/src/test/java/org/apache/commons/xml/TransformerHandlerTest.java +++ b/src/test/java/org/apache/commons/xml/TransformerHandlerTest.java @@ -51,7 +51,7 @@ private static String transformViaHandler(final TransformerHandler handler) thro @Test void secureGetTransformerDoesNotLeakDocument() throws Exception { // The f004 bypass: pull the inner Transformer out of the handler and transform directly; the floor must ride along. - final SAXTransformerFactory factory = SaxSurfaceTestSupport.hardenedFactory(); + final SAXTransformerFactory factory = SaxSurfaceTestSupport.secureFactory(); final TransformerHandler handler = factory.newTransformerHandler(AttackTestSupport.resourceSource("with-document.xsl")); final StringWriter sink = new StringWriter(); handler.getTransformer().transform(AttackTestSupport.streamSource("<root/>"), new StreamResult(sink)); @@ -60,14 +60,14 @@ void secureGetTransformerDoesNotLeakDocument() throws Exception { @Test void secureTransformerHandlerDoesNotLeakDocument() throws Exception { - final SAXTransformerFactory factory = SaxSurfaceTestSupport.hardenedFactory(); + final SAXTransformerFactory factory = SaxSurfaceTestSupport.secureFactory(); final TransformerHandler handler = factory.newTransformerHandler(AttackTestSupport.resourceSource("with-document.xsl")); assertFalse(transformViaHandler(handler).contains(AttackTestSupport.LEAKED_MARKER), "document() through TransformerHandler leaked"); } @Test void secureTransformerHandlerFromTemplatesDoesNotLeakDocument() throws Exception { - final SAXTransformerFactory factory = SaxSurfaceTestSupport.hardenedFactory(); + final SAXTransformerFactory factory = SaxSurfaceTestSupport.secureFactory(); final Templates templates = factory.newTemplates(AttackTestSupport.resourceSource("with-document.xsl")); assertNotNull(templates, "stylesheet failed to compile"); final TransformerHandler handler = factory.newTransformerHandler(templates); diff --git a/src/test/java/org/apache/commons/xml/XMLFilterTest.java b/src/test/java/org/apache/commons/xml/XMLFilterTest.java index 75f26c7..06079d7 100644 --- a/src/test/java/org/apache/commons/xml/XMLFilterTest.java +++ b/src/test/java/org/apache/commons/xml/XMLFilterTest.java @@ -76,20 +76,20 @@ private static void setPermissiveParentOnAndroid(final XMLFilter filter) { @Test void secureFilterDoesNotLeakDocument() throws Exception { - final XMLFilter filter = SaxSurfaceTestSupport.hardenedFactory().newXMLFilter(AttackTestSupport.resourceSource("with-document.xsl")); + final XMLFilter filter = SaxSurfaceTestSupport.secureFactory().newXMLFilter(AttackTestSupport.resourceSource("with-document.xsl")); assertFalse(filterAndCapture(filter, "<root/>").contains(AttackTestSupport.LEAKED_MARKER), "document() through XMLFilter leaked"); } @Test void secureFilterDoesNotLeakExternalEntity() throws Exception { // The f003 vector: with no caller-set parent, the input must be parsed by a secure reader, not a self-provisioned permissive one. - final XMLFilter filter = SaxSurfaceTestSupport.hardenedFactory().newXMLFilter(AttackTestSupport.streamSource(IDENTITY_XSLT)); + final XMLFilter filter = SaxSurfaceTestSupport.secureFactory().newXMLFilter(AttackTestSupport.streamSource(IDENTITY_XSLT)); assertFalse(filterAndCapture(filter, entityPayload()).contains(AttackTestSupport.LEAKED_MARKER), "external entity through XMLFilter leaked"); } @Test void secureFilterFromTemplatesDoesNotLeakDocument() throws Exception { - final SAXTransformerFactory factory = SaxSurfaceTestSupport.hardenedFactory(); + final SAXTransformerFactory factory = SaxSurfaceTestSupport.secureFactory(); final Templates templates = factory.newTemplates(AttackTestSupport.resourceSource("with-document.xsl")); assertNotNull(templates, "stylesheet failed to compile"); final XMLFilter filter = factory.newXMLFilter(templates);
