Return-Path: X-Original-To: apmail-flex-commits-archive@www.apache.org Delivered-To: apmail-flex-commits-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 4A64E18646 for ; Thu, 23 Jul 2015 12:53:35 +0000 (UTC) Received: (qmail 22015 invoked by uid 500); 23 Jul 2015 12:53:22 -0000 Delivered-To: apmail-flex-commits-archive@flex.apache.org Received: (qmail 21988 invoked by uid 500); 23 Jul 2015 12:53:22 -0000 Mailing-List: contact commits-help@flex.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@flex.apache.org Delivered-To: mailing list commits@flex.apache.org Received: (qmail 21980 invoked by uid 99); 23 Jul 2015 12:53:22 -0000 Received: from git1-us-west.apache.org (HELO git1-us-west.apache.org) (140.211.11.23) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 23 Jul 2015 12:53:22 +0000 Received: by git1-us-west.apache.org (ASF Mail Server at git1-us-west.apache.org, from userid 33) id 79068E6812; Thu, 23 Jul 2015 12:53:22 +0000 (UTC) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: cdutz@apache.org To: commits@flex.apache.org Message-Id: <48aa19233e1d4795a054cf3059d4bc56@git.apache.org> X-Mailer: ASF-Git Admin Mailer Subject: flex-blazeds git commit: Created a portable test for the xml parsing problem. Date: Thu, 23 Jul 2015 12:53:22 +0000 (UTC) Repository: flex-blazeds Updated Branches: refs/heads/develop af405aa59 -> cefee6684 Created a portable test for the xml parsing problem. Project: http://git-wip-us.apache.org/repos/asf/flex-blazeds/repo Commit: http://git-wip-us.apache.org/repos/asf/flex-blazeds/commit/cefee668 Tree: http://git-wip-us.apache.org/repos/asf/flex-blazeds/tree/cefee668 Diff: http://git-wip-us.apache.org/repos/asf/flex-blazeds/diff/cefee668 Branch: refs/heads/develop Commit: cefee6684909415844e59c706404ea7ec701dff8 Parents: af405aa Author: Christofer Dutz Authored: Thu Jul 23 14:53:14 2015 +0200 Committer: Christofer Dutz Committed: Thu Jul 23 14:53:14 2015 +0200 ---------------------------------------------------------------------- .../BlazeDsXmlProcessingXXEVulnerability.java | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/flex-blazeds/blob/cefee668/modules/testsuite/src/test/java/flex/messaging/securityadvisories/BlazeDsXmlProcessingXXEVulnerability.java ---------------------------------------------------------------------- diff --git a/modules/testsuite/src/test/java/flex/messaging/securityadvisories/BlazeDsXmlProcessingXXEVulnerability.java b/modules/testsuite/src/test/java/flex/messaging/securityadvisories/BlazeDsXmlProcessingXXEVulnerability.java index 71519dc..39da7a4 100644 --- a/modules/testsuite/src/test/java/flex/messaging/securityadvisories/BlazeDsXmlProcessingXXEVulnerability.java +++ b/modules/testsuite/src/test/java/flex/messaging/securityadvisories/BlazeDsXmlProcessingXXEVulnerability.java @@ -2,11 +2,14 @@ package flex.messaging.securityadvisories; import com.sun.org.apache.xml.internal.serialize.OutputFormat; import com.sun.org.apache.xml.internal.serialize.XMLSerializer; +import flex.messaging.util.DoubleUtil; import flex.messaging.util.XMLUtil; import junit.framework.Assert; import junit.framework.TestCase; import org.w3c.dom.Document; +import java.io.File; +import java.io.PrintWriter; import java.io.StringWriter; /** @@ -16,12 +19,21 @@ import java.io.StringWriter; public class BlazeDsXmlProcessingXXEVulnerability extends TestCase { public void testVulnerability() throws Exception { + int secret = (int) (Math.random() * 1000); + + // Create a temp file containing a secret. + File temp = File.createTempFile("xxe-test", ".txt"); + PrintWriter out = new PrintWriter(temp); + out.println(Integer.toString(secret)); + out.close(); + + String uri = temp.toURI().toASCIIString(); StringBuffer xml = new StringBuffer(512); xml.append("\r\n"); xml.append("\r\n"); - xml.append("]>\r\n"); - xml.append("&xxe;"); + xml.append("]>\r\n"); + xml.append("The Secret is: &xxe;"); Document data = XMLUtil.stringToDocument(xml.toString()); @@ -30,7 +42,7 @@ public class BlazeDsXmlProcessingXXEVulnerability extends TestCase { XMLSerializer serial = new XMLSerializer(stringOut, format); serial.serialize(data); - Assert.assertTrue(stringOut.toString().contains("&xxe;")); + Assert.assertFalse(stringOut.toString().contains("The Secret is: " + Integer.toString(secret))); } }