This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/commons-secure-xml.git
commit ddfead8a0ccb2241ca6d9387c88870a63877c366 Author: Gary Gregory <[email protected]> AuthorDate: Tue Oct 6 11:32:58 2026 -0400 Add XInclude tests to use an actual file. --- .../secure/SecureDocumentBuilderFactoryTest.java | 24 ++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/test/java/org/apache/commons/xml/secure/SecureDocumentBuilderFactoryTest.java b/src/test/java/org/apache/commons/xml/secure/SecureDocumentBuilderFactoryTest.java index 75948e4..0a21f05 100644 --- a/src/test/java/org/apache/commons/xml/secure/SecureDocumentBuilderFactoryTest.java +++ b/src/test/java/org/apache/commons/xml/secure/SecureDocumentBuilderFactoryTest.java @@ -201,4 +201,28 @@ void newNSInstanceFollowsParserSelection() throws Exception { } } + @Test + void xincludeTrueWithFile() throws Exception { + Assumptions.assumeTrue(AttackTestSupport.DOM_SUPPORTS_XINCLUDE, "the platform DOM does not support XInclude"); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); + factory.setNamespaceAware(true); + factory.setXIncludeAware(true); + final DocumentBuilder builder = factory.newDocumentBuilder(); + builder.setEntityResolver((publicId, systemId) -> systemId != null && systemId.endsWith("referenced.xml") + ? new InputSource(AttackTestSupport.resourceUrl("referenced.xml").toString()) + : null); + final Document document = builder.parse(AttackTestSupport.resourceUrl("with-xinclude.xml").toString()); + assertEquals("All your base are belong to us", document.getDocumentElement().getTextContent().trim()); + } + + @Test + void xincludeFalseWithFile() throws Exception { + Assumptions.assumeTrue(AttackTestSupport.DOM_SUPPORTS_XINCLUDE, "the platform DOM does not support XInclude"); + final DocumentBuilderFactory factory = SecureDocumentBuilderFactory.newInstance(); + factory.setNamespaceAware(true); + factory.setXIncludeAware(false); + final Document document = factory.newDocumentBuilder().parse(AttackTestSupport.resourceUrl("with-xinclude.xml").toString()); + assertEquals("", document.getDocumentElement().getTextContent().trim()); + } + }
