Keep XMLUnit from re-parsing documents with an unhardened parser - #110
Merged
Merged
Conversation
`<xu:assertDocumentsEqual>` fed the XML text of both dom4j documents to XMLUnit's `Diff`, which re-parses it with XMLUnit's own JAXP DocumentBuilder. That parser fetches the external DTD of any document with a DOCTYPE, regardless of how the documents were read in the first place. The tag now builds the two DOM trees itself with a DocumentBuilder from Commons Secure XML and hands those to XMLUnit, so no external entity is fetched on the comparison path either. The ignoreWhitespace attribute still reaches the builder, as it did through XMLUnit's global setting. A regression test compares a document whose DOCTYPE points to a DTD that does not exist, with and without ignoreWhitespace, since the latter routes the trees through XMLUnit's whitespace-stripping transform. Assisted-By: Claude Fable 5.1 <noreply@anthropic.com>
Member
|
Thank you @ppkarwasz , merged 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
<xu:assertDocumentsEqual>fed the XML text of both dom4j documents to XMLUnit'sDiff, which re-parses it with XMLUnit's own JAXPDocumentBuilder. That parser fetches the external DTD of any document with a DOCTYPE, regardless of how the documents were read in the first place.The tag now builds the two DOM trees itself with a
DocumentBuilderfrom Commons Secure XML and hands those toDiff(Document, Document), so no external entity is fetched on the comparison path either. TheignoreWhitespaceattribute still reaches the builder, as it did through XMLUnit's global setting, and XMLUnit's whitespace stripping keeps working on the trees it receives.A regression test compares an in-memory document whose DOCTYPE points to a DTD that does not exist, with and without
ignoreWhitespace, since the latter routes the trees through XMLUnit's whitespace-stripping transform. Both cases fail on master and pass with this change.Independent of the dom4j 2.1.5 /
SAXReaderpull request; together they close both external-fetch paths of the xmlunit tag library.🤖 Generated with Claude Code