Stefan Bodewig's Weblog

Weblog Main Feeds

• NAnt (1)
• QMQP (1)
• XMLUnit (46)
• antcontrib (1)
• blosxom (1)

About Me Homepage Family Articles Talks
My PGP key

Categories Archive

• adjusted the NUnit 3.x constraints so they should work for NUnit 4.x as well.
  Issue #40.
• add a new ElementSelectors.ByNameAndAllAttributes variant that filters attributes before deciding whether elements can be compared.
  Inspired by Issue #xmlunit/259
• Nodes.GetMergedNestedText and Nodes.StripElementContentWhitespace had the same problem of not knowning about XmlWhitespace that caused Issue #38. And neither of the methods could deal with XmlSignificantWhitespace at all.
• add XmlWhitespaceStrippedSource, XmlWhitespaceNormalizedSource, and XmlElementContentWhitespaceStrippedSource that only trim characters that are considered whitespace by the XML Specification from textual content.
  Also added new modifiers to DiffBuilder that make use of the new ISource types.
  Issue #39.

path: /en/oss/XMLUnit | #

• oss
• XMLUnit

XMLUnit for Java's Transform's default transformation allowed the use of XSLT extension functions - this has been changed in 2.10.0.

If you've been using XMLUnit to run XSLT transformations with untrusted stylesheets and your setup is so that an attacker can chose the stylesheet and ensure your XSLT processor can run the extensions this may lead to a remote code execution in the worst setup. Therefore the old default has been assigned CVE-2024-31573.

Some XSLT processors - e.g. Apache Xalan - allow the extension code to be specified inline with an Apache BSF enabled scripting language - note that would require your code executing the transformation to also have BSF around. In outher cases your transformation would need to allow the attacker to also inject Java classes into your running process. This combined with my believe that XMLUnit is very unlikely to be run in a setup like this made me set the impact to "Low".

Advisory: https://github.com/xmlunit/xmlunit/security/advisories/GHSA-chfm-68vv-pvw5

path: /en/oss/XMLUnit | #

• oss
• XMLUnit

• add a new ElementSelectors.byNameAndAllAttributes variant that filters attributes before deciding whether elements can be compared.
  Inspired by Issue #259.
• By default the TransformerFactorys created will now try to disable extension functions. If you need extension functions for your transformations you may want to pass in your own instance of TransformerFactory and TransformerFactoryConfigurer may help with that.
  Inspired by Issue #264.
• JAXPXPathEngine will now try to disable the execution of extension functions by default but uses XPathFactory#setProperty which is not available prior to Java 18. You may want to enable secure processing on an XPathFactory instance you pass to JAXPXPathEngine instead - and XPathFactoryConfigurer may help with that.

path: /en/oss/XMLUnit | #

• oss
• XMLUnit

I've just released a small minor release of XMLUnit.NET that fixes a bug with whitespace normalization/stripping and adds a small feature simplifying the use of NodeFilters.

Full list of changes:

• added NodeFilters#SatisfiesAll and SatifiesAny methods to make it easier to combine multiple node filters.
  added to simplify the use case of xmlunit/#249
• when documents contained element content whitespace represented by System.Xml.XmlWhitespace the types and methods that are supposed to strip or normalize whitespace would fail.
  Issue #38

path: /en/oss/XMLUnit | #

• oss
• XMLUnit

Full list of changes:

• fixed some AssertJ tests that didn't work on Windows.
  Issue #252 and PR #253 by @Boiarshinov
• added overloads to ElementSelectors.byXPath that accept a XPathEngine argument.
  Issue #255
• added Cyclone DX SBOMs to release artifacts

path: /en/oss/XMLUnit | #

• oss
• XMLUnit