88use DOMException ;
99use PHPUnit \Framework \Attributes \CoversClass ;
1010use PHPUnit \Framework \Attributes \Group ;
11+ use PHPUnit \Framework \Attributes \RequiresOperatingSystemFamily ;
1112use PHPUnit \Framework \TestCase ;
1213use RuntimeException ;
1314use SimpleSAML \Assert \AssertionFailedException ;
@@ -54,15 +55,14 @@ protected function tearDown(): void
5455 * Classic external-entity payload aimed at a file we control.
5556 * The factory must reject the document; the marker must never appear.
5657 */
58+ #[RequiresOperatingSystemFamily('Linux ' )]
5759 public function testExternalEntityCannotReadLocalFileUsingDefaultOptions (): void
5860 {
5961 // file:// URI pointing at our temporary secret
60- $ uri = 'file:// ' . $ this ->secretFile ;
61-
62+ $ uri = 'file:/// ' . $ this ->secretFile ;
6263 $ payload = <<<XML
6364<?xml version="1.0" encoding="UTF-8"?>
6465<!DOCTYPE foo [
65- <!ELEMENT foo ANY>
6666 <!ENTITY xxe SYSTEM " {$ uri }">
6767]>
6868<foo>&xxe;</foo>
@@ -73,7 +73,7 @@ public function testExternalEntityCannotReadLocalFileUsingDefaultOptions(): void
7373 $ xml = $ doc ->saveXml ();
7474 $ this ->assertStringNotContainsString (
7575 $ this ->marker ,
76- $ xml ,
76+ ( string ) $ xml ,
7777 'XXE succeeded: local file content was expanded into the document ' ,
7878 );
7979 }
@@ -83,15 +83,14 @@ public function testExternalEntityCannotReadLocalFileUsingDefaultOptions(): void
8383 * Classic external-entity payload aimed at a file we control.
8484 * The factory must reject the document; the marker must never appear.
8585 */
86+ #[RequiresOperatingSystemFamily('Linux ' )]
8687 public function testExternalEntityCannotReadLocalFileUsingNonDefaultOptions (): void
8788 {
8889 // file:// URI pointing at our temporary secret
8990 $ uri = 'file:// ' . $ this ->secretFile ;
90-
9191 $ payload = <<<XML
9292<?xml version="1.0" encoding="UTF-8"?>
9393<!DOCTYPE foo [
94- <!ELEMENT foo ANY>
9594 <!ENTITY xxe SYSTEM " {$ uri }">
9695]>
9796<foo>&xxe;</foo>
@@ -102,7 +101,7 @@ public function testExternalEntityCannotReadLocalFileUsingNonDefaultOptions(): v
102101 $ xml = $ doc ->saveXml ();
103102 $ this ->assertStringContainsString (
104103 $ this ->marker ,
105- $ xml ,
104+ ( string ) $ xml ,
106105 'XXE succeeded: local file content was expanded into the document ' ,
107106 );
108107 }
@@ -111,14 +110,14 @@ public function testExternalEntityCannotReadLocalFileUsingNonDefaultOptions(): v
111110 /**
112111 * Same idea with a UTF-16LE encoded payload.
113112 */
113+ #[RequiresOperatingSystemFamily('Linux ' )]
114114 public function testUtf16ExternalEntityCannotReadLocalFileUsingDefaultOptions (): void
115115 {
116116 $ uri = 'file:// ' . $ this ->secretFile ;
117117
118118 $ utf8 = <<<XML
119119<?xml version="1.0" encoding="UTF-16"?>
120120<!DOCTYPE foo [
121- <!ELEMENT foo ANY>
122121 <!ENTITY xxe SYSTEM " {$ uri }">
123122]>
124123<foo>&xxe;</foo>
@@ -131,7 +130,7 @@ public function testUtf16ExternalEntityCannotReadLocalFileUsingDefaultOptions():
131130 $ xml = $ doc ->saveXml ();
132131 $ this ->assertStringNotContainsString (
133132 $ this ->marker ,
134- $ xml ,
133+ ( string ) $ xml ,
135134 'XXE succeeded: local file content was expanded into the document ' ,
136135 );
137136 }
@@ -140,14 +139,14 @@ public function testUtf16ExternalEntityCannotReadLocalFileUsingDefaultOptions():
140139 /**
141140 * Same idea with a UTF-16LE encoded payload.
142141 */
142+ #[RequiresOperatingSystemFamily('Linux ' )]
143143 public function testUtf16ExternalEntityCannotReadLocalFileUsingNonDefaultOptions (): void
144144 {
145145 $ uri = 'file:// ' . $ this ->secretFile ;
146146
147147 $ utf8 = <<<XML
148148<?xml version="1.0" encoding="UTF-16"?>
149149<!DOCTYPE foo [
150- <!ELEMENT foo ANY>
151150 <!ENTITY xxe SYSTEM " {$ uri }">
152151]>
153152<foo>&xxe;</foo>
@@ -160,7 +159,7 @@ public function testUtf16ExternalEntityCannotReadLocalFileUsingNonDefaultOptions
160159 $ xml = mb_convert_encoding ($ doc ->saveXml (), 'UTF-8 ' , 'UTF-16LE ' );
161160 $ this ->assertStringContainsString (
162161 $ this ->marker ,
163- $ xml ,
162+ ( string ) $ xml ,
164163 'XXE succeeded: local file content was expanded into the document ' ,
165164 );
166165 }
0 commit comments