pidgin/ljfisher-ssl-client-auth

Add a silly little check to make sure our xml parser isn't vulnerable to the

2011-06-22, Mark Doliner
186f61a85ac2
Parents 8300e1e9a38c
Children 3368a7044a4a
Add a silly little check to make sure our xml parser isn't vulnerable to the
billion laughs attack. I think because we specify NULL as the entity
resolver, attempts to define entities in an xml doc just get ignored.
4 files changed, 37 insertions(+), 0 deletions(-)
  • +1 -0
    libpurple/tests/Makefile.am
  • +1 -0
    libpurple/tests/check_libpurple.c
  • +34 -0
    libpurple/tests/test_xmlnode.c
  • +1 -0
    libpurple/tests/tests.h
    • --- a/libpurple/tests/Makefile.am Tue Jun 21 07:43:07 2011 +0000
    +++ b/libpurple/tests/Makefile.am Wed Jun 22 17:43:51 2011 +0000
    @@ -17,6 +17,7 @@
    test_oscar_util.c \
    test_yahoo_util.c \
    test_util.c \
    + test_xmlnode.c \
    $(top_builddir)/libpurple/util.h
    check_libpurple_CFLAGS=\
    --- a/libpurple/tests/check_libpurple.c Tue Jun 21 07:43:07 2011 +0000
    +++ b/libpurple/tests/check_libpurple.c Wed Jun 22 17:43:51 2011 +0000
    @@ -91,6 +91,7 @@
    srunner_add_suite(sr, oscar_util_suite());
    srunner_add_suite(sr, yahoo_util_suite());
    srunner_add_suite(sr, util_suite());
    + srunner_add_suite(sr, xmlnode_suite());
    /* make this a libpurple "ui" */
    purple_check_init();
    --- /dev/null Thu Jan 01 00:00:00 1970 +0000
    +++ b/libpurple/tests/test_xmlnode.c Wed Jun 22 17:43:51 2011 +0000
    @@ -0,0 +1,34 @@
    +#include <string.h>
    +
    +#include "tests.h"
    +#include "../xmlnode.h"
    +
    +/*
    + * If we really wanted to test the billion laughs attack we would
    + * need to have more than just 4 ha's. But as long as this shorter
    + * document fails to parse, the longer one should also fail to parse.
    + */
    +START_TEST(test_xmlnode_billion_laughs_attack)
    +{
    + const char *malicious_xml_doc = "<!DOCTYPE root [ <!ENTITY ha \"Ha !\"><!ENTITY ha2 \"&ha; &ha;\"><!ENTITY ha3 \"&ha2; &ha2;\"> ]><root>&ha3;</root>";
    +
    + /* Uncomment this line if you want to see the error message given by
    + the parser for the above XML document */
    + /* purple_debug_set_enabled(TRUE); */
    +
    + fail_if(xmlnode_from_str(malicious_xml_doc, -1),
    + "xmlnode_from_str() returned an XML tree, but we didn't want it to");
    +}
    +END_TEST
    +
    +Suite *
    +xmlnode_suite(void)
    +{
    + Suite *s = suite_create("Utility Functions");
    +
    + TCase *tc = tcase_create("xmlnode");
    + tcase_add_test(tc, test_xmlnode_billion_laughs_attack);
    + suite_add_tcase(s, tc);
    +
    + return s;
    +}
    --- a/libpurple/tests/tests.h Tue Jun 21 07:43:07 2011 +0000
    +++ b/libpurple/tests/tests.h Wed Jun 22 17:43:51 2011 +0000
    @@ -16,6 +16,7 @@
    Suite * oscar_util_suite(void);
    Suite * yahoo_util_suite(void);
    Suite * util_suite(void);
    +Suite * xmlnode_suite(void);
    /* helper macros */
    #define assert_int_equal(expected, actual) { \