diff options
author | Hiroshi SHIBATA <hsbt@ruby-lang.org> | 2020-01-12 09:15:46 +0900 |
---|---|---|
committer | SHIBATA Hiroshi <hsbt@ruby-lang.org> | 2020-01-12 12:28:29 +0900 |
commit | c7ef7d8a7387e427c394c3c0d03b8dd102e97b29 (patch) | |
tree | 6fd65e7fba962ff5fc80a4fc0c891085ff826a47 /spec/ruby | |
parent | e61cab3a367c4040a2a487dd893c7be9a37889a9 (diff) | |
download | ruby-c7ef7d8a7387e427c394c3c0d03b8dd102e97b29.tar.gz |
Also ignored cve_2014_8080_spec
Diffstat (limited to 'spec/ruby')
-rw-r--r-- | spec/ruby/security/cve_2014_8080_spec.rb | 51 |
1 files changed, 27 insertions, 24 deletions
diff --git a/spec/ruby/security/cve_2014_8080_spec.rb b/spec/ruby/security/cve_2014_8080_spec.rb index 64e22cf3a7..d881032ef7 100644 --- a/spec/ruby/security/cve_2014_8080_spec.rb +++ b/spec/ruby/security/cve_2014_8080_spec.rb @@ -1,32 +1,35 @@ require_relative '../spec_helper' -require 'rexml/document' -describe "REXML::Document.new" do +ruby_version_is ''...'2.8' do + require 'rexml/document' - it "resists CVE-2014-8080 by raising an exception when entity expansion has grown too large" do - xml = <<XML - <?xml version="1.0" encoding="UTF-8" ?> - <!DOCTYPE x [ - <!ENTITY % x0 "xxxxxxxxxx"> - <!ENTITY % x1 "%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;"> - <!ENTITY % x2 "%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;"> - <!ENTITY % x3 "%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;"> - <!ENTITY % x4 "%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;"> - <!ENTITY % x5 "%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;"> - <!ENTITY % x6 "%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;"> - <!ENTITY % x7 "%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;"> - <!ENTITY % x8 "%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;"> - <!ENTITY % x9 "%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;"> - ]> - <x> - %x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9; - </x> + describe "REXML::Document.new" do + + it "resists CVE-2014-8080 by raising an exception when entity expansion has grown too large" do + xml = <<XML + <?xml version="1.0" encoding="UTF-8" ?> + <!DOCTYPE x [ + <!ENTITY % x0 "xxxxxxxxxx"> + <!ENTITY % x1 "%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;%x0;"> + <!ENTITY % x2 "%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;%x1;"> + <!ENTITY % x3 "%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;%x2;"> + <!ENTITY % x4 "%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;%x3;"> + <!ENTITY % x5 "%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;%x4;"> + <!ENTITY % x6 "%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;%x5;"> + <!ENTITY % x7 "%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;%x6;"> + <!ENTITY % x8 "%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;%x7;"> + <!ENTITY % x9 "%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;%x8;"> + ]> + <x> + %x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9;%x9; + </x> XML - -> { - REXML::Document.new(xml).doctype.entities['x9'].value - }.should raise_error(REXML::ParseException, /entity expansion has grown too large/) - end + -> { + REXML::Document.new(xml).doctype.entities['x9'].value + }.should raise_error(REXML::ParseException, /entity expansion has grown too large/) + end + end end |