From d034df36e8cf97e6e978ec6d75e66f76ef589263 Mon Sep 17 00:00:00 2001
From: Claudio Salazar <csalazar@spect.cl>
Date: Sat, 5 Apr 2014 00:22:36 +0800
Subject: [PATCH] Added test against XXE attacks for Sitemap

---
 scrapy/tests/test_utils_sitemap.py | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/scrapy/tests/test_utils_sitemap.py b/scrapy/tests/test_utils_sitemap.py
index 0049e5c40..56585143f 100644
--- a/scrapy/tests/test_utils_sitemap.py
+++ b/scrapy/tests/test_utils_sitemap.py
@@ -188,13 +188,28 @@ Disallow: /forum/active/
             <xhtml:link rel="alternate" hreflang="en"/><!-- wrong tag without href -->
         </url>
     </urlset>""")
-        
+
         self.assertEqual(list(s), [
             {'loc': 'http://www.example.com/english/',
              'alternate': ['http://www.example.com/deutsch/', 'http://www.example.com/schweiz-deutsch/', 'http://www.example.com/english/']
             }
         ])
 
+    def test_xml_entity_expansion(self):
+        s = Sitemap("""<?xml version="1.0" encoding="utf-8"?>
+          <!DOCTYPE foo [
+          <!ELEMENT foo ANY >
+          <!ENTITY xxe SYSTEM "file:///etc/passwd" >
+          ]>
+          <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+            <url>
+              <loc>http://127.0.0.1:8000/&xxe;</loc>
+            </url>
+          </urlset>
+        """)
+
+        self.assertEqual(list(s), [{'loc': 'http://127.0.0.1:8000/'}])
+
 
 if __name__ == '__main__':
     unittest.main()