rexml_spec.rb

##
# AUTHORS: Geoffrey Grosenbach http://nubyonrails.com
#          Also http://p.ramaze.net/1887  
#
# INSTALLATION:
#          Copy to spec/lib/rexml_spec.rb, or any subdirectory of "spec"
#
# RUN:
#   spec spec/lib/rexml_spec.rb
#    
#   Or, just run your specs as usual.
#
# The MIT License (use however you wish)
# 
# Copyright (c) 2008 Topfunky Corporation
# 
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
# 
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
# 
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.


require File.dirname(__FILE__) + '/../spec_helper'

describe REXML do

  it "handles DOS vulnerability" do
    # From http://p.ramaze.net/1887
    dom = REXML::Document.new('<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE member [
      <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
      <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
      <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
      <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
      <!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
      <!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
      <!ENTITY g "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
    ]>
    <member>
    &a;
    </member>')

    lambda {
      dom.root.elements.to_a('//member').first.text
    }.should raise_error(RuntimeError, "Number of entity expansions exceeded, processing aborted.")
  end

end