summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Lenz <thomas.lenz@egiz.gv.at>2017-06-22 14:56:15 +0200
committerThomas Lenz <thomas.lenz@egiz.gv.at>2017-06-22 14:56:15 +0200
commitd840a372f84518c4026efd3d463cfcffac930e46 (patch)
tree63e3e273ceeb8f55de18467eda109c0f488c5f67
parent345a8534ff39cc9550cbacabe2b3fffe20293508 (diff)
downloadmocca-d840a372f84518c4026efd3d463cfcffac930e46.tar.gz
mocca-d840a372f84518c4026efd3d463cfcffac930e46.tar.bz2
mocca-d840a372f84518c4026efd3d463cfcffac930e46.zip
update jUnit test do validate XXE prevention in Signed data viewer
-rw-r--r--BKUViewer/src/test/java/at/gv/egiz/bku/slxhtml/ValidatorTest.java22
-rw-r--r--BKUViewer/src/test/resources/at/gv/egiz/bku/slxhtml/zugang_with_DocType.xhtml21
2 files changed, 43 insertions, 0 deletions
diff --git a/BKUViewer/src/test/java/at/gv/egiz/bku/slxhtml/ValidatorTest.java b/BKUViewer/src/test/java/at/gv/egiz/bku/slxhtml/ValidatorTest.java
index 1dd8c45f..d51b52eb 100644
--- a/BKUViewer/src/test/java/at/gv/egiz/bku/slxhtml/ValidatorTest.java
+++ b/BKUViewer/src/test/java/at/gv/egiz/bku/slxhtml/ValidatorTest.java
@@ -71,4 +71,26 @@ public class ValidatorTest {
}
+ @Test
+ public void testValidateWithDocType() throws ValidationException {
+
+ String slxhtmlFile = "at/gv/egiz/bku/slxhtml/zugang_with_DocType.xhtml";
+
+ Validator validator = ValidatorFactory.newValidator("application/xhtml+xml");
+
+ ClassLoader cl = ValidatorTest.class.getClassLoader();
+ InputStream slxhtml = cl.getResourceAsStream(slxhtmlFile);
+ long t0 = System.currentTimeMillis();
+ try {
+ validator.validate(slxhtml, null);
+
+ } catch (ValidationException e) {
+ e.printStackTrace();
+ throw e;
+ }
+ long t1 = System.currentTimeMillis();
+ log.info("Validated SLXHTML file '{}' in {}ms.", slxhtmlFile, t1 - t0);
+
+ }
+
}
diff --git a/BKUViewer/src/test/resources/at/gv/egiz/bku/slxhtml/zugang_with_DocType.xhtml b/BKUViewer/src/test/resources/at/gv/egiz/bku/slxhtml/zugang_with_DocType.xhtml
new file mode 100644
index 00000000..7417897f
--- /dev/null
+++ b/BKUViewer/src/test/resources/at/gv/egiz/bku/slxhtml/zugang_with_DocType.xhtml
@@ -0,0 +1,21 @@
+<!DOCTYPE lolz [
+ <!ELEMENT foo ANY >
+ <!ENTITY xxe SYSTEM "file:///etc/testtesttst" >
+]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ <title>&xxe;Signatur der Anmeldedaten</title>
+ <style media="screen" type="text/css">.boldstyle { font-weight: bold; } .italicstyle { font-style: italic; } .annotationstyle { font-size: small; }</style>
+ </head>
+ <body>
+ <h1>Signatur der Anmeldedaten</h1>
+ <p></p>
+ <h4>Mit meiner elektronischen Signatur beantrage ich, <span class="boldstyle">Horst Rotzstopper</span>, geboren am 12.12.1985, den Zugang zur gesicherten Anwendung.</h4>
+ <p></p>
+ <h4>Datum und Uhrzeit: 07.11.2008, 14:04:18</h4>
+ <h4>wbPK(*): LTpz8VYzns2jrx0J8Gm/R/nAhxA=</h4>
+ <p></p>
+ <hr></hr>
+ <div class="annotationstyle">(*) wbPK: Das <span class="italicstyle">wirtschaftsbereichsspezifische Personenkennzeichen</span> wird aus den jeweiligen Stammzahlen des Bürgers und des Wirtschaftsunternehmens berechnet und ermöglicht eine eindeutige Zuordnung des Bürgers zum Wirtschaftsunternehmen.</div>
+ </body>
+</html> \ No newline at end of file