Merge "BUG-2511 Fix possible XXE vulnerability in restconf"
authorTony Tkacik <ttkacik@cisco.com>
Mon, 15 Dec 2014 14:57:59 +0000 (14:57 +0000)
committerGerrit Code Review <gerrit@opendaylight.org>
Mon, 15 Dec 2014 14:57:59 +0000 (14:57 +0000)
26 files changed:
opendaylight/adsal/hosttracker_new/api/src/main/java/org/opendaylight/controller/hosttracker/Entity.java
opendaylight/adsal/hosttracker_new/api/src/main/java/org/opendaylight/controller/hosttracker/SwitchPort.java
opendaylight/adsal/hosttracker_new/api/src/main/java/org/opendaylight/controller/hosttracker/hostAware/HostNodeConnector.java
opendaylight/adsal/northbound/commons/src/main/java/org/opendaylight/controller/northbound/commons/query/IteratableTypeInfo.java
opendaylight/adsal/northbound/commons/src/main/java/org/opendaylight/controller/northbound/commons/query/QueryContextImpl.java
opendaylight/adsal/northbound/commons/src/main/java/org/opendaylight/controller/northbound/commons/query/QueryImpl.java
opendaylight/adsal/northbound/commons/src/main/java/org/opendaylight/controller/northbound/commons/query/TypeInfo.java
opendaylight/adsal/northbound/commons/src/main/java/org/opendaylight/controller/northbound/commons/query/WrapperTypeInfo.java
opendaylight/config/config-api/src/main/java/org/opendaylight/controller/config/api/JmxAttributeValidationException.java
opendaylight/config/config-api/src/main/java/org/opendaylight/controller/config/api/jmx/ObjectNameUtil.java
opendaylight/config/yang-jmx-generator/pom.xml
opendaylight/config/yang-jmx-generator/src/main/java/org/opendaylight/controller/config/yangjmxgenerator/ModuleMXBeanEntryBuilder.java
opendaylight/config/yang-jmx-generator/src/main/java/org/opendaylight/controller/config/yangjmxgenerator/RuntimeBeanEntry.java
opendaylight/config/yang-jmx-generator/src/test/java/org/opendaylight/controller/config/yangjmxgenerator/RuntimeBeanEntryTest.java
opendaylight/config/yang-test/src/main/java/org/opendaylight/controller/config/yang/test/util/NetconfTestImplModuleUtil.java
opendaylight/config/yang-test/src/main/yang/config-test-impl.yang
opendaylight/config/yang-test/src/main/yang/types/test-groups.yang [new file with mode: 0644]
opendaylight/config/yang-test/src/main/yang/types/test-types.yang
opendaylight/md-sal/sal-binding-broker/src/main/java/org/opendaylight/controller/sal/binding/impl/RpcProviderRegistryImpl.java
opendaylight/md-sal/sal-binding-broker/src/main/java/org/opendaylight/controller/sal/binding/impl/connect/dom/DomToBindingRpcForwarder.java
opendaylight/netconf/config-netconf-connector/src/test/java/org/opendaylight/controller/netconf/confignetconfconnector/NetconfMappingTest.java
opendaylight/netconf/netconf-api/src/main/java/org/opendaylight/controller/netconf/api/NetconfDocumentedException.java
opendaylight/netconf/netconf-it/src/test/java/org/opendaylight/controller/netconf/it/AbstractNetconfConfigTest.java
opendaylight/netconf/netconf-it/src/test/java/org/opendaylight/controller/netconf/it/NetconfConfigPersisterITTest.java
opendaylight/netconf/netconf-util/src/main/java/org/opendaylight/controller/netconf/util/xml/XmlUtil.java
opendaylight/netconf/netconf-util/src/test/java/org/opendaylight/controller/netconf/util/xml/XmlUtilTest.java

index 64f4c7e..f10c116 100644 (file)
@@ -165,8 +165,9 @@ public class Entity implements Comparable<Entity> {
     public void setLastSeenTimestamp(Date lastSeenTimestamp) {
         if (activeSince == null
                 || (activeSince.getTime() + ACTIVITY_TIMEOUT) < lastSeenTimestamp
-                        .getTime())
+                        .getTime()) {
             this.activeSince = lastSeenTimestamp;
+        }
         this.lastSeenTimestamp = lastSeenTimestamp;
     }
 
@@ -180,8 +181,9 @@ public class Entity implements Comparable<Entity> {
 
     @Override
     public int hashCode() {
-        if (hashCode != 0)
+        if (hashCode != 0) {
             return hashCode;
+        }
         final int prime = 31;
         hashCode = 1;
         hashCode = prime * hashCode
@@ -194,30 +196,40 @@ public class Entity implements Comparable<Entity> {
 
     @Override
     public boolean equals(Object obj) {
-        if (this == obj)
+        if (this == obj) {
             return true;
-        if (obj == null)
+        }
+        if (obj == null) {
             return false;
-        if (getClass() != obj.getClass())
+        }
+        if (getClass() != obj.getClass()) {
             return false;
+        }
         Entity other = (Entity) obj;
         if (ipv4Address == null) {
-            if (other.ipv4Address != null)
+            if (other.ipv4Address != null) {
                 return false;
-        } else if (!ipv4Address.equals(other.ipv4Address))
+            }
+        } else if (!ipv4Address.equals(other.ipv4Address)) {
             return false;
-        if (macAddress != other.macAddress)
+        }
+        if (macAddress != other.macAddress) {
             return false;
+        }
         if (port == null) {
-            if (other.port != null)
+            if (other.port != null) {
                 return false;
-        } else if (!port.equals(other.port))
+            }
+        } else if (!port.equals(other.port)) {
             return false;
+        }
         if (vlan == null) {
-            if (other.vlan != null)
+            if (other.vlan != null) {
                 return false;
-        } else if (!vlan.equals(other.vlan))
+            }
+        } else if (!vlan.equals(other.vlan)) {
             return false;
+        }
         return true;
     }
 
@@ -257,8 +269,9 @@ public class Entity implements Comparable<Entity> {
             Comparable switchId = (Comparable) port.getNode().getID();
             Comparable oswitchId = (Comparable) o.port.getNode().getID();
             r = switchId.compareTo(oswitchId);
-            if (r != 0)
+            if (r != 0) {
                 return r;
+            }
 
             Comparable portId = (Comparable) port.getID();
             Comparable oportId = (Comparable) o.port.getID();
index e60f8b4..892e1d6 100644 (file)
@@ -127,20 +127,26 @@ public class SwitchPort {
 
     @Override
     public boolean equals(Object obj) {
-        if (this == obj)
+        if (this == obj) {
             return true;
-        if (obj == null)
+        }
+        if (obj == null) {
             return false;
-        if (getClass() != obj.getClass())
+        }
+        if (getClass() != obj.getClass()) {
             return false;
+        }
         SwitchPort other = (SwitchPort) obj;
-        if (errorStatus != other.errorStatus)
+        if (errorStatus != other.errorStatus) {
             return false;
+        }
         if (port == null) {
-            if (other.port != null)
+            if (other.port != null) {
                 return false;
-        } else if (!port.equals(other.port))
+            }
+        } else if (!port.equals(other.port)) {
             return false;
+        }
         return true;
     }
 
index fe396ba..86376be 100644 (file)
@@ -150,22 +150,29 @@ public class HostNodeConnector extends Host {
 
     @Override
     public boolean equals(Object obj) {
-        if (this == obj)
+        if (this == obj) {
             return true;
-        if (!super.equals(obj))
+        }
+        if (!super.equals(obj)) {
             return false;
-        if (getClass() != obj.getClass())
+        }
+        if (getClass() != obj.getClass()) {
             return false;
+        }
         HostNodeConnector other = (HostNodeConnector) obj;
         if (nodeConnector == null) {
-            if (other.nodeConnector != null)
+            if (other.nodeConnector != null) {
                 return false;
-        } else if (!nodeConnector.equals(other.nodeConnector))
+            }
+        } else if (!nodeConnector.equals(other.nodeConnector)) {
             return false;
-        if (staticHost != other.staticHost)
+        }
+        if (staticHost != other.staticHost) {
             return false;
-        if (vlan != other.vlan)
+        }
+        if (vlan != other.vlan) {
             return false;
+        }
         return true;
     }
 
@@ -181,8 +188,9 @@ public class HostNodeConnector extends Host {
             EthernetAddress e = (EthernetAddress) getDataLayerAddress();
             macaddr = e.getValue();
         }
-        if (macaddr == null)
+        if (macaddr == null) {
             return false;
+        }
         return !Arrays.equals(emptyArray, macaddr);
     }
 
index 3977837..d0386ed 100644 (file)
@@ -29,7 +29,9 @@ import java.util.List;
             Object item = it.next();
             for (TypeInfo child : _types.values()) {
                 Object val = child.retrieve(item, query, index);
-                if (val != null) objects.add(val);
+                if (val != null) {
+                    objects.add(val);
+                }
             }
         }
         return objects;
@@ -38,7 +40,9 @@ import java.util.List;
 
     @Override
     public synchronized void explore() {
-        if (_explored) return;
+        if (_explored) {
+            return;
+        }
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("exploring iteratable type: {} gtype: {}", _class,
                     _accessor.getGenericType());
index 13d70b1..8f83c14 100644 (file)
@@ -16,17 +16,25 @@ import org.slf4j.LoggerFactory;
 
     @Override
     public <T> Query<T> createQuery(String queryString, Class<T> type) throws QueryException {
-        if (queryString == null || queryString.trim().length() == 0) return null;
+        if (queryString == null || queryString.trim().length() == 0) {
+            return null;
+        }
         try {
-            if (LOGGER.isDebugEnabled()) LOGGER.debug("Processing query: {}", queryString);
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Processing query: {}", queryString);
+            }
             // FiqlParser is a parser generated by javacc
             Expression expression = FiqlParser.parse(queryString);
-            if (LOGGER.isDebugEnabled()) LOGGER.debug("Query expression: {}", expression);
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Query expression: {}", expression);
+            }
             // create Query and return;
             return new QueryImpl<T>(type, expression);
         } catch (Exception ex) {
-            if (LOGGER.isDebugEnabled()) LOGGER.error("Query processing failed = {}",
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.error("Query processing failed = {}",
                     queryString, ex);
+            }
             throw new QueryException("Unable to parse query.", ex);
         }
     }
index a520f98..cb77e04 100644 (file)
@@ -158,7 +158,9 @@ import org.slf4j.LoggerFactory;
     }
 
     private boolean compare(Object valueToMatch, Object actualValue, OP operator) {
-        if (valueToMatch == null || actualValue == null) return false;
+        if (valueToMatch == null || actualValue == null) {
+            return false;
+        }
         if (ALLOW_OBJECT_STRING_COMPARE && (valueToMatch instanceof String)
                 && !(actualValue instanceof String)) {
             actualValue = actualValue.toString();
@@ -203,7 +205,9 @@ import org.slf4j.LoggerFactory;
         }
     }
     private Object parse(String arg, Object value) {
-        if (value == null) return null;
+        if (value == null) {
+            return null;
+        }
 
         try {
             if (value instanceof String) {
index 91f01d8..6c0c5dc 100644 (file)
@@ -107,7 +107,9 @@ import org.slf4j.LoggerFactory;
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("retrieve: {}/{} type:{}", index, query.length, target.getClass());
         }
-        if (index >= query.length) return null;
+        if (index >= query.length) {
+            return null;
+        }
         explore();
         if (!target.getClass().equals(_class)) {
             if (_class.isAssignableFrom(target.getClass())) {
@@ -124,7 +126,9 @@ import org.slf4j.LoggerFactory;
             }
         }
         TypeInfo child = getChild(query[index]);
-        if (child == null) return null;
+        if (child == null) {
+            return null;
+        }
         target = child.getAccessor().getValue(target);
         if (index+1 == query.length) {
             // match found
@@ -137,27 +141,35 @@ import org.slf4j.LoggerFactory;
      * Explore the type info for children.
      */
     public synchronized void explore() {
-        if (_explored) return;
+        if (_explored) {
+            return;
+        }
         for (Class<?> c = _class; c != null; c = c.getSuperclass()) {
-            if (c.equals(Object.class)) break;
+            if (c.equals(Object.class)) {
+                break;
+            }
             // Currently only fields and methods annotated with JAXB annotations are
             // considered as valid for search purposes.
             //check methods first
             for (Method m : c.getDeclaredMethods()) {
                 String tn = getTypeName(m, _accessType);
                 if (tn != null) {
-                    if (LOGGER.isDebugEnabled()) LOGGER.debug(
+                    if (LOGGER.isDebugEnabled()) {
+                        LOGGER.debug(
                             "exploring type: {} name: {} method: {}",
                             _class.getSimpleName(), tn, m);
+                    }
                     _types.put(tn, createTypeInfo(tn, new Accessor(m)));
                 }
             }
             for (Field f : c.getDeclaredFields()) {
                 String tn = getTypeName(f, _accessType);
                 if (tn != null) {
-                    if (LOGGER.isDebugEnabled()) LOGGER.debug(
+                    if (LOGGER.isDebugEnabled()) {
+                        LOGGER.debug(
                             "exploring type: {} name: {} field: {}",
                             _class.getSimpleName(), tn, f);
+                    }
                     _types.put(tn, createTypeInfo(tn, new Accessor(f)));
                 }
             }
@@ -219,7 +231,9 @@ import org.slf4j.LoggerFactory;
             PropertyDescriptor[] props = info.getPropertyDescriptors();
             for (PropertyDescriptor pd : props)
             {
-                if (m.equals(pd.getReadMethod())) return pd.getName();
+                if (m.equals(pd.getReadMethod())) {
+                    return pd.getName();
+                }
             }
         }
         catch (IntrospectionException e)
@@ -234,8 +248,12 @@ import org.slf4j.LoggerFactory;
         // root is always a composite type
         // FIXME assert its a JAXB type
         XmlRootElement root = clz.getAnnotation(XmlRootElement.class);
-        if (root == null) throw new IllegalArgumentException("Not a JAXB type: " + clz);
-        if (name == null) name = getRootName(clz);
+        if (root == null) {
+            throw new IllegalArgumentException("Not a JAXB type: " + clz);
+        }
+        if (name == null) {
+            name = getRootName(clz);
+        }
         return new TypeInfo(name, clz, null);
     }
 
@@ -252,7 +270,9 @@ import org.slf4j.LoggerFactory;
 
     public static String getRootName(Class<?> cls) {
         XmlRootElement root = cls.getAnnotation(XmlRootElement.class);
-        if (root == null) return null;
+        if (root == null) {
+            return null;
+        }
         String rootName = root.name();
         if (DEFAULT_NAME.equals(rootName)) {
             String clsName = cls.getSimpleName();
@@ -281,7 +301,9 @@ import org.slf4j.LoggerFactory;
                 return null;
             }
         }
-        if (DEFAULT_NAME.equals(name)) return dflt;
+        if (DEFAULT_NAME.equals(name)) {
+            return dflt;
+        }
         return name;
     }
 
index a8172f2..156942c 100644 (file)
@@ -24,10 +24,14 @@ public class WrapperTypeInfo extends TypeInfo {
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("retrieve collection: {}/{}", index, query.length);
         }
-        if (index >= query.length) return null;
+        if (index >= query.length) {
+            return null;
+        }
         explore();
         TypeInfo child = getChild(query[index]);
-        if (child == null) return null;
+        if (child == null) {
+            return null;
+        }
         if (query.length == index+1) { // skipping this node
             return target;
         }else { // if list of list go to next node to get value
@@ -37,7 +41,9 @@ public class WrapperTypeInfo extends TypeInfo {
 
     @Override
     public synchronized void explore() {
-        if (_explored) return;
+        if (_explored) {
+            return;
+        }
         if (LOGGER.isDebugEnabled()) {
             LOGGER.debug("exploring wrapper type: {} gtype: {}", _class,
                     _accessor.getGenericType());
index 3380a10..b09017f 100644 (file)
@@ -84,7 +84,7 @@ public class JmxAttributeValidationException extends RuntimeException {
 
     public static void checkCondition(boolean condition, String message,
             JmxAttribute jmxAttribute) throws JmxAttributeValidationException {
-        if (condition == false) {
+        if (!condition) {
             throw new JmxAttributeValidationException(
                     jmxAttribute.getAttributeName() + " " + message,
                     jmxAttribute);
index ee23206..0c7478d 100644 (file)
@@ -128,7 +128,7 @@ public class ObjectNameUtil {
         if (quoted == null) {
             throw new IllegalArgumentException("Cannot find " + SERVICE_QNAME_KEY + " in " + objectName);
         }
-        if (quoted.startsWith("\"") == false || quoted.endsWith("\"") == false) {
+        if (!quoted.startsWith("\"") || !quoted.endsWith("\"")) {
             throw new IllegalArgumentException("Quotes not found in " + objectName);
         }
         String substring = quoted.substring(1);
@@ -201,7 +201,7 @@ public class ObjectNameUtil {
             throw new IllegalArgumentException(
                     "Expected ObjectName with transaction:" + inputON);
         }
-        if (ON_DOMAIN.equals(inputON.getDomain()) == false) {
+        if (!ON_DOMAIN.equals(inputON.getDomain())) {
             throw new IllegalArgumentException("Expected different domain: "
                     + inputON);
         }
@@ -263,7 +263,7 @@ public class ObjectNameUtil {
         Map<String, String> allProperties = getAdditionalProperties(on);
         Map<String, String> result = new HashMap<>();
         for (Entry<String, String> entry : allProperties.entrySet()) {
-            if (blacklist.contains(entry.getKey()) == false) {
+            if (!blacklist.contains(entry.getKey())) {
                 result.put(entry.getKey(), entry.getValue());
             }
         }
index 979b396..bfeb3f0 100644 (file)
       <groupId>org.opendaylight.yangtools</groupId>
       <artifactId>binding-type-provider</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.opendaylight.yangtools</groupId>
+      <artifactId>yang-model-util</artifactId>
+    </dependency>
 
     <dependency>
       <groupId>org.opendaylight.yangtools</groupId>
index 80db46d..ed727c9 100644 (file)
@@ -374,7 +374,7 @@ final class ModuleMXBeanEntryBuilder {
             final String javaNamePrefix) {
 
         return RuntimeBeanEntry.extractClassNameToRuntimeBeanMap(packageName, dataNodeContainer, moduleLocalNameFromXPath,
-                typeProviderWrapper, javaNamePrefix, currentModule).values();
+                typeProviderWrapper, javaNamePrefix, currentModule, schemaContext).values();
 
     }
 
index b6ed824..74981a9 100644 (file)
@@ -11,8 +11,14 @@ import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 
 import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Function;
 import com.google.common.base.Optional;
+import com.google.common.base.Preconditions;
+import com.google.common.collect.Collections2;
+import com.google.common.collect.HashMultimap;
 import com.google.common.collect.Lists;
+import com.google.common.collect.Multimap;
+import com.google.common.collect.Sets;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
@@ -20,6 +26,7 @@ import java.util.Comparator;
 import java.util.Deque;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
@@ -36,15 +43,16 @@ import org.opendaylight.yangtools.yang.common.QName;
 import org.opendaylight.yangtools.yang.model.api.ContainerSchemaNode;
 import org.opendaylight.yangtools.yang.model.api.DataNodeContainer;
 import org.opendaylight.yangtools.yang.model.api.DataSchemaNode;
-import org.opendaylight.yangtools.yang.model.api.IdentitySchemaNode;
 import org.opendaylight.yangtools.yang.model.api.LeafListSchemaNode;
 import org.opendaylight.yangtools.yang.model.api.LeafSchemaNode;
 import org.opendaylight.yangtools.yang.model.api.ListSchemaNode;
 import org.opendaylight.yangtools.yang.model.api.Module;
 import org.opendaylight.yangtools.yang.model.api.RpcDefinition;
+import org.opendaylight.yangtools.yang.model.api.SchemaContext;
 import org.opendaylight.yangtools.yang.model.api.SchemaNode;
 import org.opendaylight.yangtools.yang.model.api.UnknownSchemaNode;
 import org.opendaylight.yangtools.yang.model.api.UsesNode;
+import org.opendaylight.yangtools.yang.model.util.SchemaContextUtil;
 
 /**
  * Holds information about runtime bean to be generated. There are two kinds of
@@ -56,6 +64,21 @@ import org.opendaylight.yangtools.yang.model.api.UsesNode;
  * lined via children so that a tree with all beans can be created.
  */
 public class RuntimeBeanEntry {
+
+    private static final Function<SchemaNode, QName> QNAME_FROM_NODE = new Function<SchemaNode, QName>() {
+        @Override
+        public QName apply(final SchemaNode input) {
+            return input.getQName();
+        }
+    };
+
+    private static final Function<UnknownSchemaNode, String> UNKNOWN_NODE_TO_STRING = new Function<UnknownSchemaNode, String>() {
+        @Override
+        public String apply(final UnknownSchemaNode input) {
+            return input.getQName().getLocalName() + input.getNodeParameter();
+        }
+    };
+
     private final String packageName;
     private final String yangName, javaNamePrefix;
     private final boolean isRoot;
@@ -112,13 +135,12 @@ public class RuntimeBeanEntry {
     public static Map<String, RuntimeBeanEntry> extractClassNameToRuntimeBeanMap(
             final String packageName, final DataNodeContainer container,
             final String moduleYangName, final TypeProviderWrapper typeProviderWrapper,
-            final String javaNamePrefix, final Module currentModule) {
+            final String javaNamePrefix, final Module currentModule, final SchemaContext schemaContext) {
 
-        Map<QName, Set<RpcDefinition>> identitiesToRpcs = getIdentitiesToRpcs(currentModule);
 
         AttributesRpcsAndRuntimeBeans attributesRpcsAndRuntimeBeans = extractSubtree(
                 packageName, container, typeProviderWrapper, currentModule,
-                identitiesToRpcs);
+                schemaContext);
         Map<String, RuntimeBeanEntry> result = new HashMap<>();
 
         List<AttributeIfc> attributes;
@@ -150,52 +172,41 @@ public class RuntimeBeanEntry {
         return result;
     }
 
-    private static Map<QName/* of identity */, Set<RpcDefinition>> getIdentitiesToRpcs(
-            final Module currentModule) {
-        // currently only looks for local identities (found in currentModule)
-        Map<QName, Set<RpcDefinition>> result = new HashMap<>();
-        for (IdentitySchemaNode identity : currentModule.getIdentities()) {
-            // add all
-            result.put(identity.getQName(), new HashSet<RpcDefinition>());
-        }
+    private static Multimap<QName/* of identity */, RpcDefinition> getIdentitiesToRpcs(
+            final SchemaContext schemaCtx) {
+        Multimap<QName, RpcDefinition> result = HashMultimap.create();
+        for (Module currentModule : schemaCtx.getModules()) {
 
-        for (RpcDefinition rpc : currentModule.getRpcs()) {
-            ContainerSchemaNode input = rpc.getInput();
-            if (input != null) {
-                for (UsesNode uses : input.getUses()) {
+            // Find all identities in current module for later identity->rpc mapping
+            Set<QName> allIdentitiesInModule = Sets.newHashSet(Collections2.transform(currentModule.getIdentities(), QNAME_FROM_NODE));
 
-                    if (uses.getGroupingPath().getPath().size() != 1) {
-                        continue;
-                    }
+            for (RpcDefinition rpc : currentModule.getRpcs()) {
+                ContainerSchemaNode input = rpc.getInput();
+                if (input != null) {
+                    for (UsesNode uses : input.getUses()) {
 
-                    // check grouping path
-                    QName qname = uses.getGroupingPath().getPath().get(0);
-                    if (false == qname
-                            .equals(ConfigConstants.RPC_CONTEXT_REF_GROUPING_QNAME)) {
-                        continue;
-                    }
+                        // Check if the rpc is config rpc by looking for input argument rpc-context-ref
+                        Iterator<QName> pathFromRoot = uses.getGroupingPath().getPathFromRoot().iterator();
+                        if (!pathFromRoot.hasNext() ||
+                                !pathFromRoot.next().equals(ConfigConstants.RPC_CONTEXT_REF_GROUPING_QNAME)) {
+                            continue;
+                        }
 
-                    for (SchemaNode refinedNode : uses.getRefines().values()) {
-
-                        for (UnknownSchemaNode unknownSchemaNode : refinedNode
-                                .getUnknownSchemaNodes()) {
-                            if (ConfigConstants.RPC_CONTEXT_INSTANCE_EXTENSION_QNAME
-                                    .equals(unknownSchemaNode.getNodeType())) {
-                                String localIdentityName = unknownSchemaNode
-                                        .getNodeParameter();
-                                QName identityQName = QName.create(
-                                        currentModule.getNamespace(),
-                                        currentModule.getRevision(),
-                                        localIdentityName);
-                                Set<RpcDefinition> rpcDefinitions = result
-                                        .get(identityQName);
-                                if (rpcDefinitions == null) {
-                                    throw new IllegalArgumentException(
-                                            "Identity referenced by rpc not found. Identity:"
-                                                    + localIdentityName + " , rpc "
-                                                    + rpc);
+                        for (SchemaNode refinedNode : uses.getRefines().values()) {
+                            for (UnknownSchemaNode unknownSchemaNode : refinedNode
+                                    .getUnknownSchemaNodes()) {
+                                if (ConfigConstants.RPC_CONTEXT_INSTANCE_EXTENSION_QNAME
+                                        .equals(unknownSchemaNode.getNodeType())) {
+                                    String localIdentityName = unknownSchemaNode
+                                            .getNodeParameter();
+                                    QName identityQName = QName.create(
+                                            currentModule.getNamespace(),
+                                            currentModule.getRevision(),
+                                            localIdentityName);
+                                    Preconditions.checkArgument(allIdentitiesInModule.contains(identityQName),
+                                            "Identity referenced by rpc not found. Identity: %s, rpc: %s", localIdentityName, rpc);
+                                    result.put(identityQName, rpc);
                                 }
-                                rpcDefinitions.add(rpc);
                             }
                         }
                     }
@@ -212,7 +223,9 @@ public class RuntimeBeanEntry {
     private static AttributesRpcsAndRuntimeBeans extractSubtree(
             final String packageName, final DataNodeContainer subtree,
             final TypeProviderWrapper typeProviderWrapper, final Module currentModule,
-            final Map<QName, Set<RpcDefinition>> identitiesToRpcs) {
+            final SchemaContext ctx) {
+
+        Multimap<QName, RpcDefinition> identitiesToRpcs = getIdentitiesToRpcs(ctx);
 
         List<AttributeIfc> attributes = Lists.newArrayList();
         List<RuntimeBeanEntry> runtimeBeanEntries = new ArrayList<>();
@@ -234,7 +247,7 @@ public class RuntimeBeanEntry {
                     ListSchemaNode listSchemaNode = (ListSchemaNode) child;
                     RuntimeBeanEntry hierarchicalChild = createHierarchical(
                             packageName, listSchemaNode, typeProviderWrapper,
-                            currentModule, identitiesToRpcs);
+                            currentModule, ctx);
                     runtimeBeanEntries.add(hierarchicalChild);
                 } else /* ordinary list attribute */{
                     ListAttribute listAttribute = ListAttribute.create(
@@ -258,18 +271,11 @@ public class RuntimeBeanEntry {
             if (ConfigConstants.RPC_CONTEXT_INSTANCE_EXTENSION_QNAME
                     .equals(unknownSchemaNode.getNodeType())) {
                 String localIdentityName = unknownSchemaNode.getNodeParameter();
-                QName identityQName = QName.create(currentModule.getNamespace(),
-                        currentModule.getRevision(), localIdentityName);
-                Set<RpcDefinition> rpcDefinitions = identitiesToRpcs
-                        .get(identityQName);
-                if (rpcDefinitions == null) {
-                    throw new IllegalArgumentException("Cannot find identity "
-                            + localIdentityName + " to be used as "
-                            + "context reference when resolving "
-                            + unknownSchemaNode);
-                }
+                QName identityQName = unknownSchemaNode.isAddedByUses() ?
+                        findQNameFromGrouping(subtree, ctx, unknownSchemaNode, localIdentityName) :
+                        QName.create(currentModule.getNamespace(), currentModule.getRevision(), localIdentityName);
                 // convert RpcDefinition to Rpc
-                for (RpcDefinition rpcDefinition : rpcDefinitions) {
+                for (RpcDefinition rpcDefinition : identitiesToRpcs.get(identityQName)) {
                     String name = TypeProviderWrapper
                             .findJavaParameter(rpcDefinition);
                     AttributeIfc returnType;
@@ -310,6 +316,22 @@ public class RuntimeBeanEntry {
                 attributes, rpcs);
     }
 
+    /**
+     * Find "proper" qname of unknown node in case it comes from a grouping
+     */
+    private static QName findQNameFromGrouping(final DataNodeContainer subtree, final SchemaContext ctx, final UnknownSchemaNode unknownSchemaNode, final String localIdentityName) {
+        QName identityQName = null;
+        for (UsesNode usesNode : subtree.getUses()) {
+            SchemaNode dataChildByName = SchemaContextUtil.findDataSchemaNode(ctx, usesNode.getGroupingPath());
+            Module m = SchemaContextUtil.findParentModule(ctx, dataChildByName);
+            List<UnknownSchemaNode> unknownSchemaNodes = dataChildByName.getUnknownSchemaNodes();
+            if(Collections2.transform(unknownSchemaNodes, UNKNOWN_NODE_TO_STRING).contains(UNKNOWN_NODE_TO_STRING.apply(unknownSchemaNode))) {
+                identityQName = QName.create(dataChildByName.getQName(), localIdentityName);
+            }
+        }
+        return identityQName;
+    }
+
     private static AttributeIfc getReturnTypeAttribute(final DataSchemaNode child, final TypeProviderWrapper typeProviderWrapper,
             final String packageName) {
         if (child instanceof LeafSchemaNode) {
@@ -353,13 +375,13 @@ public class RuntimeBeanEntry {
     private static RuntimeBeanEntry createHierarchical(final String packageName,
             final ListSchemaNode listSchemaNode,
             final TypeProviderWrapper typeProviderWrapper, final Module currentModule,
-            final Map<QName, Set<RpcDefinition>> identitiesToRpcs) {
+            final SchemaContext ctx) {
 
         // supported are numeric types, strings, enums
         // get all attributes
         AttributesRpcsAndRuntimeBeans attributesRpcsAndRuntimeBeans = extractSubtree(
                 packageName, listSchemaNode, typeProviderWrapper,
-                currentModule, identitiesToRpcs);
+                currentModule, ctx);
 
         Optional<String> keyYangName;
         if (listSchemaNode.getKeyDefinition().isEmpty()) {
index 1503b84..98b1f75 100644 (file)
@@ -52,7 +52,7 @@ public class RuntimeBeanEntryTest extends AbstractYangTest {
                 .getUnknownSchemaNodes();
         Map<String, RuntimeBeanEntry> runtimeBeans = RuntimeBeanEntry
                 .extractClassNameToRuntimeBeanMap(PACKAGE_NAME, caseNode, "test-name", new TypeProviderWrapper(new
-                        TypeProviderImpl(context)), "test", jmxImplModule);
+                        TypeProviderImpl(context)), "test", jmxImplModule, context);
         assertEquals(1, runtimeBeans.size());
         RuntimeBeanEntry runtimeMXBean = runtimeBeans.get("testRuntimeMXBean");
         assertTrue(runtimeMXBean.isRoot());
index 5e37f5a..2428b10 100644 (file)
@@ -11,6 +11,7 @@
 package org.opendaylight.controller.config.yang.test.util;
 
 import com.google.common.collect.Lists;
+import java.math.BigInteger;
 import java.util.List;
 import org.opendaylight.controller.config.yang.test.impl.Asdf;
 import org.opendaylight.controller.config.yang.test.impl.Deep2;
@@ -43,11 +44,36 @@ public class NetconfTestImplModuleUtil {
                 return asdf;
             }
 
+            @Override
+            public BigInteger getCommonStat() {
+                return new BigInteger("54");
+            }
+
             @Override
             public String noArg(final String arg1) {
                 return arg1.toUpperCase();
             }
 
+            @Override
+            public Long commonRpcTwo() {
+                return 1L;
+            }
+
+            @Override
+            public String commonRpcThree() {
+                return "true";
+            }
+
+            @Override
+            public Boolean commonRpc() {
+                return true;
+            }
+
+            @Override
+            public void netconfImplRpcFromGrouping() {
+                // rpc from grouping within same yang module
+            }
+
         });
 
         for (int i = 0; i < module.getSimpleShort(); i++) {
index e7aa64d..093d7b3 100644 (file)
@@ -8,6 +8,7 @@ module config-test-impl {
     import ietf-inet-types { prefix inet; revision-date 2010-09-24;}
     import rpc-context { prefix rpcx; revision-date 2013-06-17; }
     import test-types { prefix tt; revision-date 2013-11-27; }
+    import test-groups { prefix tg; revision-date 2014-12-08; }
 
     description
         "Testing IMPL";
@@ -347,6 +348,22 @@ module config-test-impl {
         }
     }
 
+    grouping netconf-impl-rpc {
+       rpcx:rpc-context-instance netconf-impl-rpc-ctx;
+    }
+
+    identity netconf-impl-rpc-ctx;
+
+    rpc netconf-impl-rpc-from-grouping {
+        input {
+            uses rpcx:rpc-context-ref {
+                refine context-instance {
+                    rpcx:rpc-context-instance "netconf-impl-rpc-ctx";
+                }
+            }
+        }
+    }
+
     augment "/config:modules/config:module/config:state" {
         case impl-netconf {
             when "/config:modules/config:module/config:type = 'impl-netconf'";
@@ -354,6 +371,11 @@ module config-test-impl {
                 // rpc
                 rpcx:rpc-context-instance "test-rpc";
 
+                // add some stats + rpc from groupings outside this module
+                uses tt:common-operational;
+                uses tg:common-operational-rpc;
+                uses netconf-impl-rpc;
+
                 // root runtime bean
                 leaf created-sessions {
                     type uint32;
diff --git a/opendaylight/config/yang-test/src/main/yang/types/test-groups.yang b/opendaylight/config/yang-test/src/main/yang/types/test-groups.yang
new file mode 100644 (file)
index 0000000..00f704b
--- /dev/null
@@ -0,0 +1,52 @@
+module test-groups {
+    yang-version 1;
+    namespace "urn:opendaylight:params:xml:ns:yang:controller:config:test:groups";
+    prefix "tg";
+
+    import rpc-context { prefix rpcx; revision-date 2013-06-17; }
+
+    description
+        "Groupings generated for testing";
+
+    revision "2014-12-08";
+
+    grouping common-operational-rpc {
+        rpcx:rpc-context-instance common-rpc-ctx;
+        rpcx:rpc-context-instance common-rpc-ctx-two;
+    }
+
+    identity common-rpc-ctx;
+    identity common-rpc-ctx-two;
+
+    rpc common-rpc {
+        input {
+            uses rpcx:rpc-context-ref {
+                refine context-instance {
+                    rpcx:rpc-context-instance "common-rpc-ctx";
+                }
+            }
+        }
+
+        output {
+            leaf output {
+                type boolean;
+            }
+        }
+    }
+
+    rpc common-rpc-two {
+        input {
+            uses rpcx:rpc-context-ref {
+                refine context-instance {
+                    rpcx:rpc-context-instance "common-rpc-ctx-two";
+                }
+            }
+        }
+
+        output {
+            leaf output {
+                type uint32;
+            }
+        }
+    }
+}
index df5387b..ee466b4 100644 (file)
@@ -3,6 +3,8 @@ module test-types {
     namespace "urn:opendaylight:params:xml:ns:yang:controller:config:test:types";
     prefix "tt";
 
+    import rpc-context { prefix rpcx; revision-date 2013-06-17; }
+
     description
         "Types generated for testing";
 
@@ -40,4 +42,34 @@ module test-types {
     identity test-identity2 {
         base test-identity1;
     }
+
+    grouping common-operational {
+       leaf common-stat {
+           type uint64;
+       }
+       // This would not work, since it clashes with identity common-rpc-ctx from test-groups
+       // Both grouping add the same unknown node "rpcx:rpc-context-instance common-rpc-ctx-three;"
+       // and we cannot match the unknown node to the grouping that added it
+       //rpcx:rpc-context-instance common-rpc-ctx-three;
+       rpcx:rpc-context-instance common-rpc-ctx-three;
+    }
+
+    //identity common-rpc-ctx;
+    identity common-rpc-ctx-three;
+
+    rpc common-rpc-three {
+        input {
+            uses rpcx:rpc-context-ref {
+                refine context-instance {
+                    rpcx:rpc-context-instance "common-rpc-ctx-three";
+                }
+            }
+        }
+
+        output {
+            leaf output {
+                type string;
+            }
+        }
+    }
 }
index 13a9f1c..de28ae8 100644 (file)
@@ -8,7 +8,13 @@
 package org.opendaylight.controller.sal.binding.impl;
 
 import static com.google.common.base.Preconditions.checkState;
-
+import com.google.common.base.Preconditions;
+import com.google.common.base.Throwables;
+import com.google.common.cache.Cache;
+import com.google.common.cache.CacheBuilder;
+import com.google.common.cache.CacheLoader;
+import com.google.common.cache.LoadingCache;
+import com.google.common.util.concurrent.UncheckedExecutionException;
 import java.util.EventListener;
 import java.util.HashMap;
 import java.util.Map;
@@ -17,7 +23,6 @@ import java.util.Set;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.atomic.AtomicBoolean;
-
 import org.opendaylight.controller.md.sal.common.api.routing.RouteChange;
 import org.opendaylight.controller.md.sal.common.api.routing.RouteChangeListener;
 import org.opendaylight.controller.md.sal.common.api.routing.RouteChangePublisher;
@@ -40,13 +45,6 @@ import org.opendaylight.yangtools.yang.binding.RpcService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import com.google.common.base.Throwables;
-import com.google.common.cache.Cache;
-import com.google.common.cache.CacheBuilder;
-import com.google.common.cache.CacheLoader;
-import com.google.common.cache.LoadingCache;
-import com.google.common.util.concurrent.UncheckedExecutionException;
-
 public class RpcProviderRegistryImpl implements RpcProviderRegistry, RouteChangePublisher<RpcContextIdentifier, InstanceIdentifier<?>> {
 
     private RuntimeCodeGenerator rpcFactory = SingletonHolder.RPC_GENERATOR_IMPL;
@@ -222,11 +220,10 @@ public class RpcProviderRegistryImpl implements RpcProviderRegistry, RouteChange
 
     }
 
-    private class RouteChangeForwarder<T extends RpcService> implements RouteChangeListener<Class<? extends BaseIdentity>, InstanceIdentifier<?>> {
-
+    private final class RouteChangeForwarder<T extends RpcService> implements RouteChangeListener<Class<? extends BaseIdentity>, InstanceIdentifier<?>> {
         private final Class<T> type;
 
-        public RouteChangeForwarder(final Class<T> type) {
+        RouteChangeForwarder(final Class<T> type) {
             this.type = type;
         }
 
@@ -256,15 +253,14 @@ public class RpcProviderRegistryImpl implements RpcProviderRegistry, RouteChange
         }
     }
 
-    public static class RpcProxyRegistration<T extends RpcService> extends AbstractObjectRegistration<T> implements RpcRegistration<T> {
-
+    private static final class RpcProxyRegistration<T extends RpcService> extends AbstractObjectRegistration<T> implements RpcRegistration<T> {
+        private final RpcProviderRegistryImpl registry;
         private final Class<T> serviceType;
-        private RpcProviderRegistryImpl registry;
 
-        public RpcProxyRegistration(final Class<T> type, final T service, final RpcProviderRegistryImpl registry) {
+        RpcProxyRegistration(final Class<T> type, final T service, final RpcProviderRegistryImpl registry) {
             super(service);
+            this.registry =  Preconditions.checkNotNull(registry);
             this.serviceType = type;
-            this.registry =  registry;
         }
 
         @Override
@@ -274,13 +270,10 @@ public class RpcProviderRegistryImpl implements RpcProviderRegistry, RouteChange
 
         @Override
         protected void removeRegistration() {
-            if (registry != null) {
-                T publicProxy = registry.getRpcService(serviceType);
-                RpcService currentDelegate = RuntimeCodeHelper.getDelegate(publicProxy);
-                if (currentDelegate == getInstance()) {
-                    RuntimeCodeHelper.setDelegate(publicProxy, null);
-                }
-                registry = null;
+            T publicProxy = registry.getRpcService(serviceType);
+            RpcService currentDelegate = RuntimeCodeHelper.getDelegate(publicProxy);
+            if (currentDelegate == getInstance()) {
+                RuntimeCodeHelper.setDelegate(publicProxy, null);
             }
         }
     }
index 0f450d1..9bff0e9 100644 (file)
@@ -3,7 +3,7 @@ package org.opendaylight.controller.sal.binding.impl.connect.dom;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkState;
 import com.google.common.base.Function;
-import com.google.common.collect.FluentIterable;
+import com.google.common.collect.Collections2;
 import com.google.common.collect.ImmutableSet;
 import com.google.common.util.concurrent.Futures;
 import com.google.common.util.concurrent.ListenableFuture;
@@ -19,7 +19,7 @@ import java.util.concurrent.Callable;
 import org.opendaylight.controller.sal.binding.api.RpcProviderRegistry;
 import org.opendaylight.controller.sal.binding.api.rpc.RpcRouter;
 import org.opendaylight.controller.sal.binding.impl.RpcProviderRegistryImpl;
-import org.opendaylight.controller.sal.core.api.Broker;
+import org.opendaylight.controller.sal.core.api.Broker.RoutedRpcRegistration;
 import org.opendaylight.controller.sal.core.api.RpcImplementation;
 import org.opendaylight.controller.sal.core.api.RpcProvisionRegistry;
 import org.opendaylight.yangtools.concepts.CompositeObjectRegistration;
@@ -45,7 +45,7 @@ class DomToBindingRpcForwarder implements RpcImplementation, InvocationHandler {
 
     private final Set<QName> supportedRpcs;
     private final WeakReference<Class<? extends RpcService>> rpcServiceType;
-    private Set<org.opendaylight.controller.sal.core.api.Broker.RoutedRpcRegistration> registrations;
+    private Set<RoutedRpcRegistration> registrations;
     private final Map<QName, RpcInvocationStrategy> strategiesByQName = new HashMap<>();
     private final WeakHashMap<Method, RpcInvocationStrategy> strategiesByMethod = new WeakHashMap<>();
     private final RpcService proxy;
@@ -102,7 +102,7 @@ class DomToBindingRpcForwarder implements RpcImplementation, InvocationHandler {
         final RpcProvisionRegistry biRpcRegistry, final RpcProviderRegistry baRpcRegistry, final RpcProviderRegistryImpl registryImpl) {
         this(service, mappingService, biRpcRegistry, baRpcRegistry,registryImpl);
 
-        final ImmutableSet.Builder<Broker.RoutedRpcRegistration> registrationsBuilder = ImmutableSet.builder();
+        final ImmutableSet.Builder<RoutedRpcRegistration> registrationsBuilder = ImmutableSet.builder();
         try {
             for (QName rpc : supportedRpcs) {
                 registrationsBuilder.add(biRpcRegistry.addRoutedRpcImplementation(rpc, this));
@@ -159,9 +159,8 @@ class DomToBindingRpcForwarder implements RpcImplementation, InvocationHandler {
     public void registerPaths(final Class<? extends BaseIdentity> context,
         final Class<? extends RpcService> service, final Set<InstanceIdentifier<?>> set) {
         QName ctx = BindingReflections.findQName(context);
-        for (YangInstanceIdentifier path : FluentIterable.from(set).transform(
-            toDOMInstanceIdentifier)) {
-            for (org.opendaylight.controller.sal.core.api.Broker.RoutedRpcRegistration reg : registrations) {
+        for (YangInstanceIdentifier path : Collections2.transform(set, toDOMInstanceIdentifier)) {
+            for (RoutedRpcRegistration reg : registrations) {
                 reg.registerPath(ctx, path);
             }
         }
@@ -185,9 +184,8 @@ class DomToBindingRpcForwarder implements RpcImplementation, InvocationHandler {
     public void removePaths(final Class<? extends BaseIdentity> context, final Class<? extends RpcService> service,
         final Set<InstanceIdentifier<?>> set) {
         QName ctx = BindingReflections.findQName(context);
-        for (YangInstanceIdentifier path : FluentIterable.from(set).transform(
-            toDOMInstanceIdentifier)) {
-            for (org.opendaylight.controller.sal.core.api.Broker.RoutedRpcRegistration reg : registrations) {
+        for (YangInstanceIdentifier path : Collections2.transform(set, toDOMInstanceIdentifier)) {
+            for (RoutedRpcRegistration reg : registrations) {
                 reg.unregisterPath(ctx, path);
             }
         }
index 5ed528e..beb3365 100644 (file)
@@ -712,7 +712,7 @@ public class NetconfMappingTest extends AbstractConfigTest {
     private List<InputStream> getYangs() throws FileNotFoundException {
         List<String> paths = Arrays.asList("/META-INF/yang/config.yang", "/META-INF/yang/rpc-context.yang",
                 "/META-INF/yang/config-test.yang", "/META-INF/yang/config-test-impl.yang", "/META-INF/yang/test-types.yang",
-                "/META-INF/yang/ietf-inet-types.yang");
+                "/META-INF/yang/test-groups.yang", "/META-INF/yang/ietf-inet-types.yang");
         final Collection<InputStream> yangDependencies = new ArrayList<>();
         for (String path : paths) {
             final InputStream is = Preconditions
index e5f3265..e1e932b 100644 (file)
@@ -45,6 +45,15 @@ public class NetconfDocumentedException extends Exception {
 
     static {
         BUILDER_FACTORY = DocumentBuilderFactory.newInstance();
+        try {
+            BUILDER_FACTORY.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            BUILDER_FACTORY.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            BUILDER_FACTORY.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            BUILDER_FACTORY.setXIncludeAware(false);
+            BUILDER_FACTORY.setExpandEntityReferences(false);
+        } catch (ParserConfigurationException e) {
+            throw new ExceptionInInitializerError(e);
+        }
         BUILDER_FACTORY.setNamespaceAware(true);
         BUILDER_FACTORY.setCoalescing(true);
         BUILDER_FACTORY.setIgnoringElementContentWhitespace(true);
index a724d1d..65810a6 100644 (file)
@@ -187,6 +187,7 @@ public abstract class AbstractNetconfConfigTest extends AbstractConfigTest {
                 "/META-INF/yang/config-test.yang",
                 "/META-INF/yang/config-test-impl.yang",
                 "/META-INF/yang/test-types.yang",
+                "/META-INF/yang/test-groups.yang",
                 "/META-INF/yang/ietf-inet-types.yang");
 
         final Collection<InputStream> yangDependencies = new ArrayList<>();
index cc17035..92c96d9 100644 (file)
@@ -112,8 +112,8 @@ public class NetconfConfigPersisterITTest extends AbstractNetconfConfigTest {
         }
 
         notificationVerifier.assertNotificationCount(2);
-        notificationVerifier.assertNotificationContent(0, 0, 0, 8);
-        notificationVerifier.assertNotificationContent(1, 4, 3, 8);
+        notificationVerifier.assertNotificationContent(0, 0, 0, 9);
+        notificationVerifier.assertNotificationContent(1, 4, 3, 9);
 
         mockedAggregator.assertSnapshotCount(2);
         // Capabilities are stripped for persister
index ee5b27b..4ae65f3 100644 (file)
@@ -49,6 +49,15 @@ public final class XmlUtil {
 
     static {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        try {
+            factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+            factory.setXIncludeAware(false);
+            factory.setExpandEntityReferences(false);
+        } catch (ParserConfigurationException e) {
+            throw new ExceptionInInitializerError(e);
+        }
         factory.setNamespaceAware(true);
         factory.setCoalescing(true);
         factory.setIgnoringElementContentWhitespace(true);
index 3796dd9..79aa565 100644 (file)
@@ -61,6 +61,18 @@ public class XmlUtilTest {
 
     }
 
+    @Test(expected = SAXParseException.class)
+    public void testXXEFlaw() throws Exception {
+        XmlUtil.readXmlToDocument("<!DOCTYPE foo [  \n" +
+                "<!ELEMENT foo ANY >\n" +
+                "<!ENTITY xxe SYSTEM \"file:///etc/passwd\" >]>\n" +
+                "<hello xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\">\n" +
+                "  <capabilities>\n" +
+                "    <capability>urn:ietf:params:netconf:base:1.0 &xxe;</capability>\n" +
+                "  </capabilities>\n" +
+                "  </hello>]]>]]>");
+    }
+
     @Test
     public void testXPath() throws Exception {
         final XPathExpression correctXPath = XMLNetconfUtil.compileXPath("/top/innerText");