104 lines
4.0 KiB
Diff
104 lines
4.0 KiB
Diff
From e9d8f115580c3a25a9579c213f096af623dd92ce Mon Sep 17 00:00:00 2001
|
|
From: Sebastian Pipping <sebastian@pipping.org>
|
|
Date: Mon, 26 Apr 2021 14:52:45 +0200
|
|
Subject: [PATCH] tests: Cover billion laughs attack protection API
|
|
|
|
---
|
|
tests/runtests.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 66 insertions(+)
|
|
|
|
diff --git a/tests/runtests.c b/tests/runtests.c
|
|
index 100574a..d4e05a7 100644
|
|
--- a/tests/runtests.c
|
|
+++ b/tests/runtests.c
|
|
@@ -45,6 +45,7 @@
|
|
#include <stddef.h> /* ptrdiff_t */
|
|
#include <ctype.h>
|
|
#include <limits.h>
|
|
+#include <math.h> /* NAN, INFINITY, isnan */
|
|
|
|
#if defined(_WIN32) && defined(_MSC_VER) && (_MSC_VER < 1600)
|
|
/* For vs2003/7.1 up to vs2008/9.0; _MSC_VER 1600 is vs2010/10.0 */
|
|
@@ -11485,6 +11486,70 @@ START_TEST(test_accounting_precision) {
|
|
}
|
|
}
|
|
END_TEST
|
|
+
|
|
+START_TEST(test_billion_laughs_attack_protection_api) {
|
|
+ XML_Parser parserWithoutParent = XML_ParserCreate(NULL);
|
|
+ XML_Parser parserWithParent
|
|
+ = XML_ExternalEntityParserCreate(parserWithoutParent, NULL, NULL);
|
|
+ if (parserWithoutParent == NULL)
|
|
+ fail("parserWithoutParent is NULL");
|
|
+ if (parserWithParent == NULL)
|
|
+ fail("parserWithParent is NULL");
|
|
+
|
|
+ // XML_SetBillionLaughsAttackProtectionMaximumAmplification, error cases
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(NULL, 123.0f)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with NULL parser is NOT supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(parserWithParent,
|
|
+ 123.0f)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with non-root parser is NOT supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, NAN)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with NaN limit is NOT supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, -1.0f)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with negative limit is NOT supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, 0.9f)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with positive limit <1.0 is NOT supposed to succeed");
|
|
+
|
|
+ // XML_SetBillionLaughsAttackProtectionMaximumAmplification, success cases
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, 1.0f)
|
|
+ == XML_FALSE)
|
|
+ fail("Call with positive limit >=1.0 is supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, 123456.789f)
|
|
+ == XML_FALSE)
|
|
+ fail("Call with positive limit >=1.0 is supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionMaximumAmplification(
|
|
+ parserWithoutParent, INFINITY)
|
|
+ == XML_FALSE)
|
|
+ fail("Call with positive limit >=1.0 is supposed to succeed");
|
|
+
|
|
+ // XML_SetBillionLaughsAttackProtectionActivationThreshold, error cases
|
|
+ if (XML_SetBillionLaughsAttackProtectionActivationThreshold(NULL, 123)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with NULL parser is NOT supposed to succeed");
|
|
+ if (XML_SetBillionLaughsAttackProtectionActivationThreshold(parserWithParent,
|
|
+ 123)
|
|
+ == XML_TRUE)
|
|
+ fail("Call with non-root parser is NOT supposed to succeed");
|
|
+
|
|
+ // XML_SetBillionLaughsAttackProtectionActivationThreshold, success cases
|
|
+ if (XML_SetBillionLaughsAttackProtectionActivationThreshold(
|
|
+ parserWithoutParent, 123)
|
|
+ == XML_FALSE)
|
|
+ fail("Call with non-NULL parentless parser is supposed to succeed");
|
|
+
|
|
+ XML_ParserFree(parserWithParent);
|
|
+ XML_ParserFree(parserWithoutParent);
|
|
+}
|
|
+END_TEST
|
|
#endif // defined(XML_DTD)
|
|
|
|
static Suite *
|
|
@@ -11859,6 +11924,7 @@ make_suite(void) {
|
|
#if defined(XML_DTD)
|
|
suite_add_tcase(s, tc_accounting);
|
|
tcase_add_test(tc_accounting, test_accounting_precision);
|
|
+ tcase_add_test(tc_accounting, test_billion_laughs_attack_protection_api);
|
|
#endif
|
|
|
|
return s;
|
|
--
|
|
1.8.3.1
|
|
|