@@ -47,7 +47,23 @@ def test_new
4747</member>
4848EOF
4949
50- XML_WITH_NESTED_PARAMETER_ENTITY = <<EOF
50+ XML_WITH_NESTED_EMPTY_ENTITY = <<EOF
51+ <?xml version="1.0" encoding="UTF-8"?>
52+ <!DOCTYPE member [
53+ <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
54+ <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
55+ <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
56+ <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
57+ <!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
58+ <!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
59+ <!ENTITY g "">
60+ ]>
61+ <member>
62+ &a;
63+ </member>
64+ EOF
65+
66+ XML_WITH_NESTED_PARAMETER_ENTITY = <<EOF
5167<!DOCTYPE root [
5268 <!ENTITY % a "BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.">
5369 <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;">
@@ -59,6 +75,20 @@ def test_new
5975 <!ENTITY test "test %g;">
6076]>
6177<cd></cd>
78+ EOF
79+
80+ XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY = <<EOF
81+ <!DOCTYPE root [
82+ <!ENTITY % a "">
83+ <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;">
84+ <!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;">
85+ <!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;">
86+ <!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;">
87+ <!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;">
88+ <!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;">
89+ <!ENTITY test "test %g;">
90+ ]>
91+ <cd></cd>
6292EOF
6393
6494 XML_WITH_4_ENTITY_EXPANSION = <<EOF
@@ -87,6 +117,18 @@ def test_entity_expansion_limit
87117 end
88118 assert_equal ( 101 , doc . entity_expansion_count )
89119
120+ doc = REXML ::Document . new ( XML_WITH_NESTED_EMPTY_ENTITY )
121+ assert_raise ( RuntimeError ) do
122+ doc . root . children . first . value
123+ end
124+ REXML ::Security . entity_expansion_limit = 100
125+ assert_equal ( 100 , REXML ::Security . entity_expansion_limit )
126+ doc = REXML ::Document . new ( XML_WITH_NESTED_EMPTY_ENTITY )
127+ assert_raise ( RuntimeError ) do
128+ doc . root . children . first . value
129+ end
130+ assert_equal ( 101 , doc . entity_expansion_count )
131+
90132 REXML ::Security . entity_expansion_limit = 4
91133 doc = REXML ::Document . new ( XML_WITH_4_ENTITY_EXPANSION )
92134 assert_equal ( "\n a\n a a\n <\n " , doc . root . children . first . value )
@@ -108,6 +150,15 @@ def test_entity_expansion_limit_for_parameter_entity
108150 assert_raise ( REXML ::ParseException ) do
109151 REXML ::Document . new ( XML_WITH_NESTED_PARAMETER_ENTITY )
110152 end
153+
154+ assert_raise ( REXML ::ParseException ) do
155+ REXML ::Document . new ( XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY )
156+ end
157+ REXML ::Security . entity_expansion_limit = 100
158+ assert_equal ( 100 , REXML ::Security . entity_expansion_limit )
159+ assert_raise ( REXML ::ParseException ) do
160+ REXML ::Document . new ( XML_WITH_NESTED_EMPTY_PARAMETER_ENTITY )
161+ end
111162 ensure
112163 REXML ::Security . entity_expansion_limit = 10000
113164 end
0 commit comments