Implement bounded XML LLSD codec

2026-08-09 01:08:14 +00:00
1 parent 2308e55671
commit 84bc31d031
@@ -0,0 +1,6 @@
+# XML LLSD security regression corpus
+
+These inputs exercise the XML LLSD parser's entity boundary. DTD declarations,
+external entities, and undeclared named entities must be rejected without file
+or network access and without entity expansion. The structured-data unit tests
+load every fixture directly.
@@ -0,0 +1 @@
+<!DOCTYPE llsd [<!ENTITY x "expanded">]><llsd><string>&x;</string></llsd>
@@ -0,0 +1 @@
+<!DOCTYPE llsd [<!ENTITY x SYSTEM "file:///etc/passwd">]><llsd><string>&x;</string></llsd>
@@ -0,0 +1 @@
+<llsd><string>&unknown;</string></llsd>
				`@@ -0,0 +1 @@`
				`<!DOCTYPE llsd [<!ENTITY x "expanded">]><llsd><string>&x;</string></llsd>`
				`@@ -0,0 +1 @@`
				`<!DOCTYPE llsd [<!ENTITY x SYSTEM "file:///etc/passwd">]><llsd><string>&x;</string></llsd>`