Mercurial > prosody-hg

annotate spec/util_xml_spec.lua @ 12659:c0eea4f6c739

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
usermanager: Add back temporary is_admin to warn about deprecated API usage Goal: Introduce role-auth with minimal disruption is_admin() is unsafe in a system with per-session permissions, so it has been deprecated. Roll-out approach: 1) First, log a warning when is_admin() is used. It should continue to function normally, backed by the new role API. Nothing is really using per-session authz yet, so there is minimal security concern. The 'strict_deprecate_is_admin' global setting can be set to 'true' to force a hard failure of is_admin() attempts (it will log an error and always return false). 2) In some time (at least 1 week), but possibly longer depending on the number of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by default. It can still be disabled for systems that need it. 3) Further in the future, before the next release, the option will be removed and is_admin() will be permanently disabled.
author Matthew Wild <mwild1@gmail.com>
date Mon, 15 Aug 2022 15:25:07 +0100
parents c78639ee6ccb
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
1
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
2 local xml = require "util.xml";
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
3
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
4 describe("util.xml", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
5 describe("#parse()", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
6 it("should work", function()
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
7 local x =
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
8 [[<x xmlns:a="b">
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
9 <y xmlns:a="c"> <!-- this overwrites 'a' -->
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
10 <a:z/>
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
11 </y>
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
12 <a:z/> <!-- prefix 'a' is nil here, but should be 'b' -->
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
13 </x>
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
14 ]]
12180
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
15 local stanza = xml.parse(x, {allow_comments = true});
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
16 assert.are.equal(stanza.tags[2].attr.xmlns, "b");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
17 assert.are.equal(stanza.tags[2].namespaces["a"], "b");
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
18 end);
12180
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
19
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
20 it("should reject doctypes", function()
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
21 local x = "<!DOCTYPE foo []><foo/>";
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
22 local ok = xml.parse(x);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
23 assert.falsy(ok);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
24 end);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
25
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
26 it("should reject comments by default", function()
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
27 local x = "<foo><!-- foo --></foo>";
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
28 local ok = xml.parse(x);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
29 assert.falsy(ok);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
30 end);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
31
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
32 it("should allow comments if asked nicely", function()
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
33 local x = "<foo><!-- foo --></foo>";
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
34 local stanza = xml.parse(x, {allow_comments = true});
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
35 assert.are.equal(stanza.name, "foo");
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
36 assert.are.equal(#stanza, 0);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
37 end);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
38
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
39 it("should reject processing instructions", function()
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
40 local x = "<foo><?php die(); ?></foo>";
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
41 local ok = xml.parse(x);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
42 assert.falsy(ok);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
43 end);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
44
12270
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
45 it("should allow processing instructions if asked nicely", function()
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
46 local x = "<?xml-stylesheet href='make-fancy.xsl'?><foo/>";
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
47 local stanza = xml.parse(x, {allow_processing_instructions = true});
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
48 assert.truthy(stanza);
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
49 assert.are.equal(stanza.name, "foo");
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
50 end);
c78639ee6ccb util.xml: Add an option to allow <?processing instructions?>
Kim Alvefur <zash@zash.se>
parents: 12180
diff changeset
51
12180
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
52 it("should allow an xml declaration", function()
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
53 local x = "<?xml version='1.0'?><foo/>";
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
54 local stanza = xml.parse(x);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
55 assert.truthy(stanza);
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
56 assert.are.equal(stanza.name, "foo");
53e0ae770917 util.xml: Do not allow doctypes, comments or processing instructions
Jonas Schäfer <jonas@wielicki.name>
parents: 8236
diff changeset
57 end);
8236
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
58 end);
4878e4159e12 Port tests to the `busted` test runner
Waqas Hussain <waqas20@gmail.com>
parents:
diff changeset
59 end);