--- a/spec/util_xmppstream_spec.lua Wed Jul 11 11:57:42 2018 +0100
+++ b/spec/util_xmppstream_spec.lua Wed Jul 11 11:58:25 2018 +0100
@@ -2,59 +2,62 @@
local xmppstream = require "util.xmppstream";
describe("util.xmppstream", function()
+ local function test(xml, expect_success, ex)
+ local stanzas = {};
+ local session = { notopen = true };
+ local callbacks = {
+ stream_ns = "streamns";
+ stream_tag = "stream";
+ default_ns = "stanzans";
+ streamopened = function (_session)
+ assert.are.equal(session, _session);
+ assert.are.equal(session.notopen, true);
+ _session.notopen = nil;
+ return true;
+ end;
+ handlestanza = function (_session, stanza)
+ assert.are.equal(session, _session);
+ assert.are.equal(_session.notopen, nil);
+ table.insert(stanzas, stanza);
+ end;
+ streamclosed = function (_session)
+ assert.are.equal(session, _session);
+ assert.are.equal(_session.notopen, nil);
+ _session.notopen = nil;
+ end;
+ }
+ if type(ex) == "table" then
+ for k, v in pairs(ex) do
+ if k ~= "_size_limit" then
+ callbacks[k] = v;
+ end
+ end
+ end
+ local stream = xmppstream.new(session, callbacks, ex and ex._size_limit or nil);
+ local ok, err = pcall(function ()
+ assert(stream:feed(xml));
+ end);
+
+ if ok and type(expect_success) == "function" then
+ expect_success(stanzas);
+ end
+ assert.are.equal(not not ok, not not expect_success, "Expected "..(expect_success and ("success ("..tostring(err)..")") or "failure"));
+ end
+
+ local function test_stanza(stanza, expect_success, ex)
+ return test([[<stream:stream xmlns:stream="streamns" xmlns="stanzans">]]..stanza, expect_success, ex);
+ end
+
describe("#new()", function()
it("should work", function()
- local function test(xml, expect_success, ex)
- local stanzas = {};
- local session = { notopen = true };
- local callbacks = {
- stream_ns = "streamns";
- stream_tag = "stream";
- default_ns = "stanzans";
- streamopened = function (_session)
- assert.are.equal(session, _session);
- assert.are.equal(session.notopen, true);
- _session.notopen = nil;
- return true;
- end;
- handlestanza = function (_session, stanza)
- assert.are.equal(session, _session);
- assert.are.equal(_session.notopen, nil);
- table.insert(stanzas, stanza);
- end;
- streamclosed = function (_session)
- assert.are.equal(session, _session);
- assert.are.equal(_session.notopen, nil);
- _session.notopen = nil;
- end;
- }
- if type(ex) == "table" then
- for k, v in pairs(ex) do
- if k ~= "_size_limit" then
- callbacks[k] = v;
- end
- end
- end
- local stream = xmppstream.new(session, callbacks, size_limit);
- local ok, err = pcall(function ()
- assert(stream:feed(xml));
- end);
-
- if ok and type(expect_success) == "function" then
- expect_success(stanzas);
- end
- assert.are.equal(not not ok, not not expect_success, "Expected "..(expect_success and ("success ("..tostring(err)..")") or "failure"));
- end
-
- local function test_stanza(stanza, expect_success, ex)
- return test([[<stream:stream xmlns:stream="streamns" xmlns="stanzans">]]..stanza, expect_success, ex);
- end
-
test([[<stream:stream xmlns:stream="streamns"/>]], true);
test([[<stream xmlns="streamns"/>]], true);
+ -- Incorrect stream tag name should be rejected
test([[<stream1 xmlns="streamns"/>]], false);
+ -- Incorrect stream namespace should be rejected
test([[<stream xmlns="streamns1"/>]], false);
+ -- Invalid XML should be rejected
test("<>", false);
test_stanza("<message/>", function (stanzas)
@@ -87,4 +90,47 @@
end);
end);
end);
+
+ it("should allow an XML declaration", function ()
+ test([[<?xml version="1.0" encoding="UTF-8"?><stream xmlns="streamns"/>]], true);
+ test([[<?xml version="1.0" encoding="UTF-8" standalone="yes" ?><stream xmlns="streamns"/>]], true);
+ test([[<?xml version="1.0" encoding="utf-8" ?><stream xmlns="streamns"/>]], true);
+ end);
+
+ it("should not accept XML versions other than 1.0", function ()
+ test([[<?xml version="1.1" encoding="utf-8" ?><stream xmlns="streamns"/>]], false);
+ end);
+
+ it("should not allow a misplaced XML declaration", function ()
+ test([[<stream xmlns="streamns"><?xml version="1.0" encoding="UTF-8"?></stream>]], false);
+ end);
+
+ describe("should forbid restricted XML:", function ()
+ it("comments", function ()
+ test_stanza("<!-- hello world -->", false);
+ end);
+ it("DOCTYPE", function ()
+ test([[<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE stream SYSTEM "mydtd.dtd">]], false);
+ end);
+ it("incorrect encoding specification", function ()
+ -- This is actually caught by the underlying XML parser
+ test([[<?xml version="1.0" encoding="UTF-16"?><stream xmlns="streamns"/>]], false);
+ end);
+ it("non-UTF8 encodings: ISO-8859-1", function ()
+ test([[<?xml version="1.0" encoding="ISO-8859-1"?><stream xmlns="streamns"/>]], false);
+ end);
+ it("non-UTF8 encodings: UTF-16", function ()
+ -- <?xml version="1.0" encoding="UTF-16"?><stream xmlns="streamns"/>
+ -- encoded into UTF-16
+ local hx = ([[fffe3c003f0078006d006c002000760065007200730069006f006e003d00
+ 220031002e0030002200200065006e0063006f00640069006e0067003d00
+ 22005500540046002d003100360022003f003e003c007300740072006500
+ 61006d00200078006d006c006e0073003d00220073007400720065006100
+ 6d006e00730022002f003e00]]):gsub("%x%x", function (c) return string.char(tonumber(c, 16)); end);
+ test(hx, false);
+ end);
+ it("processing instructions", function ()
+ test([[<stream xmlns="streamns"><?xml-stylesheet type="text/xsl" href="style.xsl"?></stream>]], false);
+ end);
+ end);
end);