This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 3.2.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git
The following commit(s) were added to refs/heads/3.2.x-fixes by this push:
new d880b69 Adding more StaxUtils tests
d880b69 is described below
commit d880b692dcdd35b9ce769329402ad8fa22bcf940
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Thu Apr 30 07:46:41 2020 +0100
Adding more StaxUtils tests
(cherry picked from commit 337b24aa40b397448caafbec65465e1181b1e1b7)
(cherry picked from commit b54e4047e5c9117d870c9a2df8db9a818890431a)
---
.../org/apache/cxf/staxutils/StaxUtilsTest.java | 144 ++++++++++++++++++++-
1 file changed, 143 insertions(+), 1 deletion(-)
diff --git a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
index e38d939..a47c9ee 100644
--- a/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
+++ b/core/src/test/java/org/apache/cxf/staxutils/StaxUtilsTest.java
@@ -30,6 +30,7 @@ import java.io.Writer;
import javax.xml.namespace.QName;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.stream.XMLStreamConstants;
+import javax.xml.stream.XMLStreamException;
import javax.xml.stream.XMLStreamReader;
import javax.xml.stream.XMLStreamWriter;
import javax.xml.stream.events.XMLEvent;
@@ -65,15 +66,17 @@ public class StaxUtilsTest extends Assert {
private InputStream getTestStream(String resource) {
return getClass().getResourceAsStream(resource);
}
+
@Test
public void testCommentNode() throws Exception {
//CXF-3034
Document document = DocumentBuilderFactory.newInstance()
- .newDocumentBuilder().newDocument();
+ .newDocumentBuilder().newDocument();
Element root = document.createElementNS("urn:test", "root");
root.appendChild(document.createComment("test comment"));
StaxUtils.copy(StaxUtils.createXMLStreamReader(root),
StaxUtils.createXMLStreamWriter(System.out));
}
+
@Test
public void testToNextElement() {
String soapMessage = "./resources/sayHiRpcLiteralReq.xml";
@@ -479,4 +482,143 @@ public class StaxUtilsTest extends Assert {
//System.out.println(sw.toString());
assertEquals(innerXml, sw.toString());
}
+
+ @Test
+ public void testIsSecureReader() {
+ Document doc = DOMUtils.newDocument();
+ Element documentElement = doc.createElementNS(null, "root");
+ doc.appendChild(documentElement);
+
+ XMLStreamReader reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ assertTrue(StaxUtils.isSecureReader(reader, null));
+ }
+
+ @Test
+ public void testDefaultMaxAttributeCount() throws XMLStreamException {
+ Document doc = DOMUtils.newDocument();
+ Element documentElement = doc.createElementNS(null, "root");
+ doc.appendChild(documentElement);
+
+ for (int i = 0; i < 300; i++) {
+ documentElement.setAttributeNS(null, "attr-" + i,
Integer.toString(i));
+ }
+
+ // Should be OK
+ XMLStreamReader reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ assertNotNull(StaxUtils.read(reader));
+
+ for (int i = 300; i < 800; i++) {
+ documentElement.setAttributeNS(null, "attr-" + i,
Integer.toString(i));
+ }
+
+ assertTrue(documentElement.getAttributes().getLength() > 500);
+
+ // Should fail as we are over the max attribute count
+ reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ try {
+ StaxUtils.read(reader);
+ fail("Failure expected on exceeding the limit");
+ } catch (XMLStreamException ex) {
+ assertTrue(ex.getMessage().contains("Attribute limit"));
+ }
+ }
+
+ @Test
+ public void testDefaultMaxAttributeLength() throws XMLStreamException {
+ Document doc = DOMUtils.newDocument();
+ Element documentElement = doc.createElementNS(null, "root");
+ doc.appendChild(documentElement);
+
+ StringBuilder sb = new StringBuilder();
+ for (int i = 0; i < 1024; i++) {
+ sb.append(i);
+ }
+
+ documentElement.setAttributeNS(null, "attr", sb.toString());
+
+ // Should be OK
+ XMLStreamReader reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ assertNotNull(StaxUtils.read(reader));
+
+ for (int i = 0; i < 1024 * 64; i++) {
+ sb.append(i);
+ }
+
+ documentElement.setAttributeNS(null, "attr", sb.toString());
+ assertTrue(documentElement.getAttributeNS(null, "attr").length() >
(1024 * 64));
+
+ // Should fail as we are over the max attribute length
+ reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ try {
+ StaxUtils.read(reader);
+ fail("Failure expected on exceeding the limit");
+ } catch (XMLStreamException ex) {
+ assertTrue(ex.getMessage().contains("Maximum attribute size
limit"));
+ }
+
+ }
+
+ @Test
+ public void testDefaultMaxElementDepth() throws XMLStreamException {
+ Document doc = DOMUtils.newDocument();
+ Element documentElement = doc.createElementNS(null, "root");
+ doc.appendChild(documentElement);
+
+ Element currentNode = documentElement;
+ for (int i = 0; i < 50; i++) {
+ Element childElement = doc.createElementNS("null", "root" + i);
+ currentNode.appendChild(childElement);
+ currentNode = childElement;
+ }
+
+ // Should be OK
+ XMLStreamReader reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ assertNotNull(StaxUtils.read(reader));
+
+ for (int i = 50; i < 102; i++) {
+ Element childElement = doc.createElementNS("null", "root" + i);
+ currentNode.appendChild(childElement);
+ currentNode = childElement;
+ }
+
+ // Should fail as we are over the max element depth value
+ reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ try {
+ StaxUtils.read(reader);
+ fail("Failure expected on exceeding the limit");
+ } catch (XMLStreamException ex) {
+ assertTrue(ex.getMessage().contains("Maximum Element Depth
limit"));
+ }
+ }
+
+ @Test
+ public void testDefaultMaxChildElements() throws XMLStreamException {
+ Document doc = DOMUtils.newDocument();
+ Element documentElement = doc.createElementNS(null, "root");
+ doc.appendChild(documentElement);
+
+ for (int i = 0; i < 1000; i++) {
+ Element childElement = doc.createElementNS("null", "root" + i);
+ documentElement.appendChild(childElement);
+ }
+
+ // Should be OK
+ XMLStreamReader reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ assertNotNull(StaxUtils.read(reader));
+
+ for (int i = 0; i < 49001; i++) {
+ Element childElement = doc.createElementNS("null", "root" + i);
+ documentElement.appendChild(childElement);
+ }
+
+ // Should fail as we are over the max element count value
+ reader = StaxUtils.createXMLStreamReader(new
StringReader(StaxUtils.toString(doc)));
+ try {
+ StaxUtils.read(reader);
+ fail("Failure expected on exceeding the limit");
+ } catch (XMLStreamException ex) {
+ assertTrue(ex.getMessage().contains("Maximum Number of Child
Elements limit"));
+ }
+ }
+
}
