From da638d6b6ef9bd38559dc9ae7c4a732547bd48d8 Mon Sep 17 00:00:00 2001
From: Brian Wolff <bawolff+wn@gmail.com>
Date: Wed, 6 Jul 2016 18:55:12 -0400
Subject: [PATCH] Add a test for entity expansion OOM in XmlTypeCheck

Change-Id: Ia255178fc893a715fd44e5c69399575ee7b12cfd
---
 .../includes/libs/XmlTypeCheckTest.php        | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/tests/phpunit/includes/libs/XmlTypeCheckTest.php b/tests/phpunit/includes/libs/XmlTypeCheckTest.php
index 80efcb3172..7f9a772aa7 100644
--- a/tests/phpunit/includes/libs/XmlTypeCheckTest.php
+++ b/tests/phpunit/includes/libs/XmlTypeCheckTest.php
@@ -30,6 +30,32 @@ class XmlTypeCheckTest extends PHPUnit_Framework_TestCase {
 		$this->assertFalse( $testXML->wellFormed );
 	}
 
+	/**
+	 * Verify we check for recursive entity DOS
+	 *
+	 * (If the DOS isn't properly handled, the test runner will probably go OOM...)
+	 */
+	public function testRecursiveEntity() {
+		$xml = <<<'XML'
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE foo [
+	<!ENTITY test "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
+	<!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
+	<!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
+	<!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
+	<!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
+	<!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
+	<!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
+	<!ENTITY g "-00000000000000000000000000000000000000000000000000000000000000000000000-">
+]>
+<foo>
+<bar>&test;</bar>
+</foo>
+XML;
+		$check = XmlTypeCheck::newFromString( $xml );
+		$this->assertFalse( $check->wellFormed );
+	}
+
 	/**
 	 * @covers XMLTypeCheck::processingInstructionHandler
 	 */
-- 
2.20.1