sup-xml 1.3.0

Modern idiomatic Rust API for SupXML
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182

/// DTD entity expansion tests.
use sup_xml::{parse_str, NodeKind, ParseOptions};

macro_rules! fixture {
    ($name:expr) => {
        include_str!(concat!(env!("CARGO_MANIFEST_DIR"), "/../../tests/fixtures/", $name))
    };
}

// ── basic entity expansion ────────────────────────────────────────────────────

#[test]
fn simple_entity_expands() {
    let xml = r#"<!DOCTYPE r [<!ENTITY greeting "Hello, World!">]><r>&greeting;</r>"#;
    let doc = parse_str(xml, &ParseOptions::default()).unwrap();
    let root = doc.root();
    assert_eq!(root.kind, NodeKind::Element);
    assert_eq!(root.children().next().unwrap().text_content(), Some("Hello, World!"));
}

#[test]
fn entity_in_attribute_expands() {
    let xml = r#"<!DOCTYPE r [<!ENTITY who "Alice">]><r name="&who;"/>"#;
    let doc = parse_str(xml, &ParseOptions::default()).unwrap();
    let el = doc.root();
    assert_eq!(el.kind, NodeKind::Element);
    assert_eq!(el.attributes().next().unwrap().value(), "Alice");
}

#[test]
fn multiple_entities_expand() {
    let xml = r#"<!DOCTYPE r [
        <!ENTITY a "AAA">
        <!ENTITY b "BBB">
    ]><r>&a;&b;</r>"#;
    let doc = parse_str(xml, &ParseOptions::default()).unwrap();
    let root = doc.root();
    let text: String = root.children()
        .filter_map(|n| n.text_content())
        .collect();
    assert_eq!(text, "AAABBB");
}

#[test]
fn entity_used_multiple_times() {
    let xml = r#"<!DOCTYPE r [<!ENTITY x "X">]><r>&x;&x;&x;</r>"#;
    let doc = parse_str(xml, &ParseOptions::default()).unwrap();
    let root = doc.root();
    let text: String = root.children()
        .filter_map(|n| n.text_content())
        .collect();
    assert_eq!(text, "XXX");
}

#[test]
fn entity_chain_expands() {
    // b references a — two-level expansion
    let xml = r#"<!DOCTYPE r [
        <!ENTITY a "inner">
        <!ENTITY b "before-&a;-after">
    ]><r>&b;</r>"#;
    let doc = parse_str(xml, &ParseOptions::default()).unwrap();
    let root = doc.root();
    let text: String = root.children()
        .filter_map(|n| n.text_content())
        .collect();
    assert_eq!(text, "before-inner-after");
}

// ── undefined entity ──────────────────────────────────────────────────────────

#[test]
fn undefined_entity_is_error() {
    let xml = "<r>&undefined;</r>";
    assert!(parse_str(xml, &ParseOptions::default()).is_err(), "undefined entity must be an error");
}

// ── recursion detection ───────────────────────────────────────────────────────

#[test]
fn direct_recursive_entity_rejected() {
    let xml = r#"<!DOCTYPE r [<!ENTITY x "&x;">]><r>&x;</r>"#;
    assert!(parse_str(xml, &ParseOptions::default()).is_err(), "direct entity recursion must be rejected");
}

#[test]
fn indirect_recursive_entity_rejected() {
    let xml = r#"<!DOCTYPE r [
        <!ENTITY a "&b;">
        <!ENTITY b "&a;">
    ]><r>&a;</r>"#;
    assert!(parse_str(xml, &ParseOptions::default()).is_err(), "indirect entity recursion must be rejected");
}

// ── billion laughs (CVE-2003-1564) ───────────────────────────────────────────

#[test]
fn billion_laughs_hits_budget() {
    let xml = fixture!("cve/billion_laughs.xml");
    let err = parse_str(xml, &ParseOptions::default()).expect_err("billion laughs must be rejected");
    let msg = err.message.to_lowercase();
    assert!(
        msg.contains("budget") || msg.contains("expansion") || msg.contains("limit") || msg.contains("bytes"),
        "error should mention budget/expansion/limit, got: {}", err.message
    );
}

#[test]
fn custom_budget_enforced() {
    // A deeply-expanded entity that's small enough with default budget but over 100 bytes.
    let xml = r#"<!DOCTYPE r [
        <!ENTITY a "AAAAAAAAAA">
        <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
        <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
    ]><r>&c;</r>"#;
    // c → 10 × b, b → 10 × a, a = 10 bytes → 10 × 10 × 10 = 1000 bytes

    // default budget (1 MB) accepts it
    parse_str(xml, &ParseOptions::default()).expect("1000-byte expansion should fit default budget");

    // budget of 500 bytes rejects it
    let opts = ParseOptions { max_entity_expansion_bytes: 500, ..Default::default() };
    let err = parse_str(xml, &opts).expect_err("500-byte budget should reject 1000-byte expansion");
    let msg = err.message.to_lowercase();
    assert!(msg.contains("budget") || msg.contains("expansion") || msg.contains("limit") || msg.contains("bytes"),
        "error should mention limit: {}", err.message);
}

// ── depth limit ───────────────────────────────────────────────────────────────

#[test]
fn depth_limit_default_allows_256() {
    let open: String = (1..=256).map(|i| format!("<l{i}>")).collect();
    let close: String = (1..=256).rev().map(|i| format!("</l{i}>")).collect();
    let xml = format!("{open}ok{close}");
    parse_str(&xml, &ParseOptions::default()).expect("256 levels must be accepted with default depth limit");
}

#[test]
fn depth_limit_rejects_257() {
    let open: String = (1..=257).map(|i| format!("<l{i}>")).collect();
    let close: String = (1..=257).rev().map(|i| format!("</l{i}>")).collect();
    let xml = format!("{open}deep{close}");
    assert!(parse_str(&xml, &ParseOptions::default()).is_err(), "257 levels must be rejected with default depth limit");
}

#[test]
fn custom_depth_limit_enforced() {
    let open: String = (1..=11).map(|i| format!("<l{i}>")).collect();
    let close: String = (1..=11).rev().map(|i| format!("</l{i}>")).collect();
    let xml = format!("{open}deep{close}");

    // limit 10 → reject 11
    let opts = ParseOptions { max_element_depth: 10, ..Default::default() };
    assert!(parse_str(&xml, &opts).is_err(), "depth 11 must be rejected when limit is 10");

    // limit 20 → accept 11
    let opts = ParseOptions { max_element_depth: 20, ..Default::default() };
    parse_str(&xml, &opts).expect("depth 11 must be accepted when limit is 20");
}

// ── predefined entities ───────────────────────────────────────────────────────

#[test]
fn predefined_entities_work_without_doctype() {
    let doc = parse_str("<r>&amp;&lt;&gt;&apos;&quot;</r>", &ParseOptions::default()).unwrap();
    let root = doc.root();
    let text: String = root.children()
        .filter_map(|n| n.text_content())
        .collect();
    assert_eq!(text, r#"&<>'""#);
}

// ── external entity blocked ───────────────────────────────────────────────────

#[test]
fn external_entity_blocked_by_default() {
    // SYSTEM entities must be silently skipped (not loaded), so no error on declaration,
    // but referencing the entity should error because it was never defined.
    let xml = r#"<!DOCTYPE r [<!ENTITY ext SYSTEM "file:///etc/passwd">]><r>&ext;</r>"#;
    assert!(parse_str(xml, &ParseOptions::default()).is_err(), "external entity reference must error when loading is disabled");
}