RomanNum3ral
/
scrapy
mirror of https://github.com/scrapy/scrapy.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added test against XXE attacks for Sitemap

This commit is contained in:
Claudio Salazar 2014-04-05 00:22:36 +08:00
parent c2a424daae
commit d034df36e8
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
scrapy/tests/test_utils_sitemap.py
View File

@ -188,13 +188,28 @@ Disallow: /forum/active/
<xhtml:link rel="alternate" hreflang="en"/><!-- wrong tag without href -->
</url>
</urlset>""")
self.assertEqual(list(s), [
{'loc': 'http://www.example.com/english/',
'alternate': ['http://www.example.com/deutsch/', 'http://www.example.com/schweiz-deutsch/', 'http://www.example.com/english/']
}
])
def test_xml_entity_expansion(self):
s = Sitemap("""<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd" >
]>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>http://127.0.0.1:8000/&xxe;</loc>
</url>
</urlset>
""")
self.assertEqual(list(s), [{'loc': 'http://127.0.0.1:8000/'}])
if __name__ == '__main__':
unittest.main()