On Jul 14, 2009, at 9:24 AM, Paul Sandoz wrote:
>
> On Jul 13, 2009, at 11:20 PM, Craig McClanahan wrote:
>
>> With the latest bits (r2499), I am getting a jersey-tests failure
>> when building the trunk (Java 1.6, on both Mac and Linux).
>>
>> -------------------------------------------------------------------------------
>> Test set: com.sun.jersey.impl.entity.XXETest
>> -------------------------------------------------------------------------------
>> Tests run: 14, Failures: 1, Errors: 0, Skipped: 0, Time elapsed:
>> 8.959 sec <<< F
>> AILURE!
>> testDOMSecure(com.sun.jersey.impl.entity.XXETest) Time elapsed:
>> 0.412 sec <<<
>> FAILURE!
>> junit.framework.ComparisonFailure: expected:<> but was:<COMPROMISED>
>> at junit.framework.Assert.assertEquals(Assert.java:81)
>> at junit.framework.Assert.assertEquals(Assert.java:87)
>> at
>> com.sun.jersey.impl.entity.XXETest.testDOMSecure(XXETest.java:290)
>>
>> Perhaps the logic to set up XML security is Java version specific?
>>
>
> The configuration is as follows:
>
> @Override
> protected DocumentBuilderFactory getInstance() {
> DocumentBuilderFactory f =
> DocumentBuilderFactory.newInstance();
>
> f.setNamespaceAware(true);
>
> if (!disableXmlSecurity) {
> f.setExpandEntityReferences(false);
> }
>
> return f;
> }
>
> Is this a bug in the DocumentBuilderFactory?
>
I found the source of the problem. It is not an issue with the
DocumentBuilderFactory but with the transformation of the DOMSource to
an XML document that is being performed by the tests. On SE 5 entities
are not expanded, on SE 6 entities are expanded. That is probably a bug.
I will modify the test accordingly.
Paul.