Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/dependency-security-regressions.test.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+const uri = require('fast-uri');
+const { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');
+const yaml = require('js-yaml');
+
+test('build dependency rejects malformed IPv6 instead of changing its destination', () => {
+  assert.ok(uri.parse('http://[::not-valid]/example').error);
+  assert.equal(uri.parse('https://example.com/path').host, 'example.com');
+});
+
+test('build XML dependency rejects invalid entity names at creation and strict serialization', () => {
+  const document = new DOMImplementation().createDocument(null, 'example', null);
+  const serializer = new XMLSerializer();
+  assert.throws(() => document.createEntityReference('bad; <element/> &suffix'));
+  const reference = document.createEntityReference('valid');
+  // xmldom 0.8 exposes strict serialization as the fourth argument.
+  assert.equal(serializer.serializeToString(reference, false, undefined, { requireWellFormed: true }), '&valid;');
+  reference.nodeName = 'bad; <element/> &suffix';
+  assert.throws(() => serializer.serializeToString(reference, false, undefined, { requireWellFormed: true }));
+});
+
+test('build YAML dependency counts empty merge sources against the work budget', () => {
+  const hostile = 'sources: &sources [{}, {}]\ntarget:\n  <<: *sources\n';
+  assert.throws(
+    () => yaml.load(hostile, { schema: yaml.YAML11_SCHEMA, maxTotalMergeKeys: 1 }),
+    /merge keys exceeded maxTotalMergeKeys \(1\)/,
+  );
+  assert.deepEqual(yaml.load('base: &base { enabled: true }\ntarget:\n  <<: *base\n'), {
+    base: { enabled: true },
+    target: { enabled: true },
+  });
+});