6 files changed, 73 insertions, 27 deletions
diff --git a/activesupport/test/xml_mini/jdom_engine_test.rb b/activesupport/test/xml_mini/jdom_engine_test.rb
index f77d78d42c..904ef7b208 100644
--- a/activesupport/test/xml_mini/jdom_engine_test.rb
+++ b/activesupport/test/xml_mini/jdom_engine_test.rb
@@ -3,9 +3,12 @@ if RUBY_PLATFORM =~ /java/
   require 'active_support/xml_mini'
   require 'active_support/core_ext/hash/conversions'
 
+
   class JDOMEngineTest < ActiveSupport::TestCase
     include ActiveSupport
 
+    FILES_DIR = File.dirname(__FILE__) + '/../fixtures/xml'
+
     def setup
       @default_backend = XmlMini.backend
       XmlMini.backend = 'JDOM'
@@ -30,10 +33,41 @@ if RUBY_PLATFORM =~ /java/
        assert_equal 'image/png', file.content_type
     end
 
+    def test_not_allowed_to_expand_entities_to_files
+      attack_xml = <<-EOT
+      <!DOCTYPE member [
+        <!ENTITY a SYSTEM "file://#{FILES_DIR}/jdom_include.txt">
+      ]>
+      <member>x&a;</member>
+      EOT
+      assert_equal 'x', Hash.from_xml(attack_xml)["member"]
+    end
+
+    def test_not_allowed_to_expand_parameter_entities_to_files
+      attack_xml = <<-EOT
+      <!DOCTYPE member [
+        <!ENTITY % b SYSTEM "file://#{FILES_DIR}/jdom_entities.txt">
+        %b;
+      ]>
+      <member>x&a;</member>
+      EOT
+      assert_raise Java::OrgXmlSax::SAXParseException do
+        assert_equal 'x', Hash.from_xml(attack_xml)["member"]
+      end
+    end
+
+
+    def test_not_allowed_to_load_external_doctypes
+      attack_xml = <<-EOT
+      <!DOCTYPE member SYSTEM "file://#{FILES_DIR}/jdom_doctype.dtd">
+      <member>x&a;</member>
+      EOT
+      assert_equal 'x', Hash.from_xml(attack_xml)["member"]
+    end
+
     def test_exception_thrown_on_expansion_attack
-      assert_raise NativeException do
+      assert_raise Java::OrgXmlSax::SAXParseException do
         attack_xml = <<-EOT
-      <?xml version="1.0" encoding="UTF-8"?>
       <!DOCTYPE member [
         <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
         <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
@@ -142,10 +176,11 @@ if RUBY_PLATFORM =~ /java/
     end
 
     private
-    def assert_equal_rexml(xml)
-      hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
-      assert_equal(hash, XmlMini.parse(xml))
-    end
+      def assert_equal_rexml(xml)
+        parsed_xml = XmlMini.parse(xml)
+        hash = XmlMini.with_backend('REXML') { parsed_xml }
+        assert_equal(hash, parsed_xml)
+      end
   end
 
 else
diff --git a/activesupport/test/xml_mini/libxml_engine_test.rb b/activesupport/test/xml_mini/libxml_engine_test.rb
index 36ac4161ea..e7cb350663 100644
--- a/activesupport/test/xml_mini/libxml_engine_test.rb
+++ b/activesupport/test/xml_mini/libxml_engine_test.rb
@@ -141,7 +141,7 @@ class LibxmlEngineTest < ActiveSupport::TestCase
       morning
     </root>
     eoxml
-    XmlMini.parse(io)
+    assert_equal_rexml(io)
   end
 
   def test_children_with_simple_cdata
@@ -193,10 +193,11 @@ class LibxmlEngineTest < ActiveSupport::TestCase
 
 
   private
-  def assert_equal_rexml(xml)
-    hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
-    assert_equal(hash, XmlMini.parse(xml))
-  end
+    def assert_equal_rexml(xml)
+      parsed_xml = XmlMini.parse(xml)
+      hash = XmlMini.with_backend('REXML') { parsed_xml }
+      assert_equal(hash, parsed_xml)
+    end
 end
 
 end
diff --git a/activesupport/test/xml_mini/libxmlsax_engine_test.rb b/activesupport/test/xml_mini/libxmlsax_engine_test.rb
index 82337961a1..07485911c9 100644
--- a/activesupport/test/xml_mini/libxmlsax_engine_test.rb
+++ b/activesupport/test/xml_mini/libxmlsax_engine_test.rb
@@ -141,7 +141,7 @@ class LibXMLSAXEngineTest < ActiveSupport::TestCase
       morning
     </root>
     eoxml
-    XmlMini.parse(io)
+    assert_equal_rexml(io)
   end
 
   def test_children_with_simple_cdata
@@ -184,10 +184,11 @@ class LibXMLSAXEngineTest < ActiveSupport::TestCase
   end
 
   private
-  def assert_equal_rexml(xml)
-    hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
-    assert_equal(hash, XmlMini.parse(xml))
-  end
+    def assert_equal_rexml(xml)
+      parsed_xml = XmlMini.parse(xml)
+      hash = XmlMini.with_backend('REXML') { parsed_xml }
+      assert_equal(hash, parsed_xml)
+    end
 end
 
 end
diff --git a/activesupport/test/xml_mini/nokogiri_engine_test.rb b/activesupport/test/xml_mini/nokogiri_engine_test.rb
index 71f57e43d2..937517786e 100644
--- a/activesupport/test/xml_mini/nokogiri_engine_test.rb
+++ b/activesupport/test/xml_mini/nokogiri_engine_test.rb
@@ -155,7 +155,7 @@ class NokogiriEngineTest < ActiveSupport::TestCase
       morning
     </root>
     eoxml
-    XmlMini.parse(io)
+    assert_equal_rexml(io)
   end
 
   def test_children_with_simple_cdata
@@ -206,10 +206,11 @@ class NokogiriEngineTest < ActiveSupport::TestCase
   end
 
   private
-  def assert_equal_rexml(xml)
-    hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
-    assert_equal(hash, XmlMini.parse(xml))
-  end
+    def assert_equal_rexml(xml)
+      parsed_xml = XmlMini.parse(xml)
+      hash = XmlMini.with_backend('REXML') { parsed_xml }
+      assert_equal(hash, parsed_xml)
+    end
 end
 
 end
diff --git a/activesupport/test/xml_mini/nokogirisax_engine_test.rb b/activesupport/test/xml_mini/nokogirisax_engine_test.rb
index 884494e95e..d4f63f6bd0 100644
--- a/activesupport/test/xml_mini/nokogirisax_engine_test.rb
+++ b/activesupport/test/xml_mini/nokogirisax_engine_test.rb
@@ -156,7 +156,7 @@ class NokogiriSAXEngineTest < ActiveSupport::TestCase
       morning
     </root>
     eoxml
-    XmlMini.parse(io)
+    assert_equal_rexml(io)
   end
 
   def test_children_with_simple_cdata
@@ -207,10 +207,11 @@ class NokogiriSAXEngineTest < ActiveSupport::TestCase
   end
 
   private
-  def assert_equal_rexml(xml)
-    hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
-    assert_equal(hash, XmlMini.parse(xml))
-  end
+    def assert_equal_rexml(xml)
+      parsed_xml = XmlMini.parse(xml)
+      hash = XmlMini.with_backend('REXML') { parsed_xml }
+      assert_equal(hash, parsed_xml)
+    end
 end
 
 end
diff --git a/activesupport/test/xml_mini/rexml_engine_test.rb b/activesupport/test/xml_mini/rexml_engine_test.rb
index c4770405f2..70a3b918fd 100644
--- a/activesupport/test/xml_mini/rexml_engine_test.rb
+++ b/activesupport/test/xml_mini/rexml_engine_test.rb
@@ -24,6 +24,13 @@ class REXMLEngineTest < ActiveSupport::TestCase
       morning
     </root>
     eoxml
-    XmlMini.parse(io)
+    assert_equal_rexml(io)
   end
+
+  private
+    def assert_equal_rexml(xml)
+      parsed_xml = XmlMini.parse(xml)
+      hash = XmlMini.with_backend('REXML') { parsed_xml }
+      assert_equal(hash, parsed_xml)
+    end
 end