Merge "BUG-2511 Fix XXE vulnerability in Netconf"
[controller.git] / opendaylight / netconf / netconf-util / src / test / java / org / opendaylight / controller / netconf / util / xml / XmlUtilTest.java
1 /*
2  * Copyright (c) 2014 Cisco Systems, Inc. and others.  All rights reserved.
3  *
4  * This program and the accompanying materials are made available under the
5  * terms of the Eclipse Public License v1.0 which accompanies this distribution,
6  * and is available at http://www.eclipse.org/legal/epl-v10.html
7  */
8
9 package org.opendaylight.controller.netconf.util.xml;
10
11 import static org.junit.Assert.assertEquals;
12 import static org.junit.Assert.assertTrue;
13 import static org.junit.Assert.fail;
14
15 import com.google.common.base.Optional;
16 import javax.xml.xpath.XPathConstants;
17 import javax.xml.xpath.XPathExpression;
18 import org.custommonkey.xmlunit.Diff;
19 import org.custommonkey.xmlunit.XMLUnit;
20 import org.junit.Test;
21 import org.w3c.dom.Document;
22 import org.w3c.dom.Element;
23 import org.xml.sax.SAXParseException;
24
25 public class XmlUtilTest {
26
27     private final String xml = "<top xmlns=\"namespace\">\n" +
28             "<innerText>value</innerText>\n" +
29             "<innerPrefixedText xmlns:pref=\"prefixNamespace\">prefix:value</innerPrefixedText>\n" +
30             "<innerPrefixedText xmlns=\"randomNamespace\" xmlns:pref=\"prefixNamespace\">prefix:value</innerPrefixedText>\n" +
31             "</top>";
32
33     @Test
34     public void testCreateElement() throws Exception {
35         final Document document = XmlUtil.newDocument();
36         final Element top = XmlUtil.createElement(document, "top", Optional.of("namespace"));
37
38         top.appendChild(XmlUtil.createTextElement(document, "innerText", "value", Optional.of("namespace")));
39         top.appendChild(XmlUtil.createTextElementWithNamespacedContent(document, "innerPrefixedText", "pref", "prefixNamespace", "value", Optional.of("namespace")));
40         top.appendChild(XmlUtil.createTextElementWithNamespacedContent(document, "innerPrefixedText", "pref", "prefixNamespace", "value", Optional.of("randomNamespace")));
41
42         document.appendChild(top);
43         assertEquals("top", XmlUtil.createDocumentCopy(document).getDocumentElement().getTagName());
44
45         XMLUnit.setIgnoreAttributeOrder(true);
46         XMLUnit.setIgnoreWhitespace(true);
47
48         final Diff diff = XMLUnit.compareXML(XMLUnit.buildControlDocument(xml), document);
49         assertTrue(diff.toString(), diff.similar());
50     }
51
52     @Test
53     public void testLoadSchema() throws Exception {
54         XmlUtil.loadSchema();
55         try {
56             XmlUtil.loadSchema(getClass().getResourceAsStream("/netconfMessages/commit.xml"));
57             fail("Input stream does not contain xsd");
58         } catch (final IllegalStateException e) {
59             assertTrue(e.getCause() instanceof SAXParseException);
60         }
61
62     }
63
64     @Test(expected = SAXParseException.class)
65     public void testXXEFlaw() throws Exception {
66         XmlUtil.readXmlToDocument("<!DOCTYPE foo [  \n" +
67                 "<!ELEMENT foo ANY >\n" +
68                 "<!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n" +
69                 "<hello xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\">\n" +
70                 "  <capabilities>\n" +
71                 "    <capability>urn:ietf:params:netconf:base:1.0 &xxe;</capability>\n" +
72                 "  </capabilities>\n" +
73                 "  </hello>]]>]]>");
74     }
75
76     @Test
77     public void testXPath() throws Exception {
78         final XPathExpression correctXPath = XMLNetconfUtil.compileXPath("/top/innerText");
79         try {
80             XMLNetconfUtil.compileXPath("!@(*&$!");
81             fail("Incorrect xpath should fail");
82         } catch (IllegalStateException e) {}
83         final Object value = XmlUtil.evaluateXPath(correctXPath, XmlUtil.readXmlToDocument("<top><innerText>value</innerText></top>"), XPathConstants.NODE);
84         assertEquals("value", ((Element) value).getTextContent());
85     }
86 }