This directory contains a security test module for XSLT done by the XsltTransformation class.
It basically checks all known (to me) possibilities for XXE (Xml eXternal Entity) attacks.

The test consists of importing and including both online and offline files. For the online
part it comes with its own mini-webserver which has to be launched before performing the
test.

=============
PREREQUISITES
=============
You will need both perl and HTTP::Server::Simple from CPAN installed if you want to run
the test.

=======
OPTIONS
=======
The test webserver uses port 8085 by default. If you want to change it, pass the port using
TEST_SERVER_PORT to cmake:

$ cmake -DTEST_SERVER_PORT=8086 <source-dir>

================
RUNNING THE TEST
================
After building, first start the mini-webserver which can be found inside the build tests
directory.

$ perl testhttpserver.pl

Next launch the test inside the build tests directory.

$ ./xsltsecuritytest

================================
RUNNING THE TEST USING A CATALOG
================================
An XML catalog represents a lookup mechanism for XML files. It's usually used to map remote
URLs (eg. for a DTD, a schema or an XSL) to locally cached versions of those files. If a
transformation is to be considered secure locally cached files have to be treated the same
as their remote counterparts.

To test this, temporarily add the <build-dir>/tests/data/catalog.xml to your global XML
catalog (/etc/xml/catalog on Debian) using the following line:

<delegateSystem systemIdStartString="http://localhost:[port]/"
                catalog="file://[build-dir]/tests/data/catalog.xml"/>

Be sure to replace [port] with TEST_SERVER_PORT (or the default value of 8085) and [build-dir]
with your cmake build directory.


Michael Leupold <lemma@confuego.org>

