diff options
Diffstat (limited to 'src/test/regress/expected/xml.out')
| -rw-r--r-- | src/test/regress/expected/xml.out | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/src/test/regress/expected/xml.out b/src/test/regress/expected/xml.out index 5dfa44b5b9..4f1e3972dc 100644 --- a/src/test/regress/expected/xml.out +++ b/src/test/regress/expected/xml.out @@ -896,3 +896,23 @@ CONTEXT: SQL function "xpath" statement 1 {"<relativens xmlns=\"relative\"/>"} (1 row) +-- External entity references should not leak filesystem information. +SELECT XMLPARSE(DOCUMENT '<!DOCTYPE foo [<!ENTITY c SYSTEM "/etc/passwd">]><foo>&c;</foo>'); + xmlparse +----------------------------------------------------------------- + <!DOCTYPE foo [<!ENTITY c SYSTEM "/etc/passwd">]><foo>&c;</foo> +(1 row) + +SELECT XMLPARSE(DOCUMENT '<!DOCTYPE foo [<!ENTITY c SYSTEM "/etc/no.such.file">]><foo>&c;</foo>'); + xmlparse +----------------------------------------------------------------------- + <!DOCTYPE foo [<!ENTITY c SYSTEM "/etc/no.such.file">]><foo>&c;</foo> +(1 row) + +-- This might or might not load the requested DTD, but it mustn't throw error. +SELECT XMLPARSE(DOCUMENT '<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"><chapter> </chapter>'); + xmlparse +------------------------------------------------------------------------------------------------------------------------------------------------------ + <!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN" "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"><chapter> </chapter> +(1 row) + |