Update responseparser

Author: barryvdh

.travis.yml

@@ -5,6 +5,7 @@ php:
   - 7.0
   - 7.1
   - hhvm
+  - nightly
 
 # This triggers builds to run on the new TravisCI infrastructure.
 # See: http://docs.travis-ci.com/user/workers/container-based-infrastructure/

src/Omnipay/Common/Http/ResponseParser.php

@@ -33,10 +33,12 @@ private static function toString($response)
     public static function json($response)
     {
         $body = static::toString($response);
+
         $data = json_decode($body, true);
         if (JSON_ERROR_NONE !== json_last_error()) {
             throw new RuntimeException('Unable to parse response body into JSON: ' . json_last_error());
         }
+
         return $data === null ? [] : $data;
     }
 
@@ -59,21 +61,22 @@ public static function json($response)
     public static function xml($response)
     {
         $body = static::toString($response);
+
         $errorMessage = null;
         $internalErrors = libxml_use_internal_errors(true);
         $disableEntities = libxml_disable_entity_loader(true);
         libxml_clear_errors();
+
         try {
             $xml = new \SimpleXMLElement((string) $body ?: '<root />', LIBXML_NONET);
-            if ($error = libxml_get_last_error()) {
-                $errorMessage = $error->message;
-            }
         } catch (\Exception $e) {
             $errorMessage = $e->getMessage();
         }
+
         libxml_clear_errors();
         libxml_use_internal_errors($internalErrors);
         libxml_disable_entity_loader($disableEntities);
+
         if ($errorMessage) {
             throw new RuntimeException('Unable to parse response body into XML: ' . $errorMessage);
         }

tests/Omnipay/Common/Http/ResponseParserTest.php

@@ -8,56 +8,80 @@
 
 class ResponseParserTest extends TestCase
 {
-    public function testParsesXmlString()
+    public function testParsesJsonString()
     {
-        $data = ResponseParser::xml('<Foo><Baz>Bar</Baz></Foo>');
+        $data = ResponseParser::json('{"Baz":"Bar"}');
 
-        $this->assertInstanceOf('SimpleXMLElement', $data);
-        $this->assertEquals('Bar', (string) $data->Baz);
+        $this->assertEquals(array('Baz' => 'Bar'), $data);
     }
 
-    public function testParsesXmlResponse()
+    public function testParsesJsonResponse()
     {
-        $response = new Response(200, [], '<Foo><Baz>Bar</Baz></Foo>');
+        $response = new Response(200, [], '{"Baz":"Bar"}');
 
-        $data = ResponseParser::xml($response);
+        $data = ResponseParser::json($response);
 
-        $this->assertInstanceOf('SimpleXMLElement', $data);
-        $this->assertEquals('Bar', (string) $data->Baz);
+        $this->assertEquals(array('Baz' => 'Bar'), $data);
     }
 
-    public function testParsesXmlResponseException()
+    /**
+     * @expectedException RuntimeException
+     * @expectedExceptionMessage Unable to parse response body into JSON: 4
+     */
+    public function testParsesJsonResponseException()
     {
         $this->expectException(RuntimeException::class);
 
         $response = new Response(200, [], 'FooBar');
 
-        ResponseParser::xml($response);
+        ResponseParser::json($response);
     }
 
-    public function testParsesJsonString()
+    public function testParsesXmlString()
     {
-        $data = ResponseParser::json('{"Baz":"Bar"}');
+        $data = ResponseParser::xml('<Foo><Baz>Bar</Baz></Foo>');
 
-        $this->assertEquals(array('Baz' => 'Bar'), $data);
+        $this->assertInstanceOf('SimpleXMLElement', $data);
+        $this->assertEquals('Bar', (string) $data->Baz);
     }
 
-    public function testParsesJsonResponse()
+    public function testParsesXmlResponse()
     {
-        $response = new Response(200, [], '{"Baz":"Bar"}');
+        $response = new Response(200, [], '<Foo><Baz>Bar</Baz></Foo>');
 
-        $data = ResponseParser::json($response);
+        $data = ResponseParser::xml($response);
 
-        $this->assertEquals(array('Baz' => 'Bar'), $data);
+        $this->assertInstanceOf('SimpleXMLElement', $data);
+        $this->assertEquals('Bar', (string) $data->Baz);
     }
 
-    public function testParsesJsonResponseException()
+    /**
+     * @expectedException RuntimeException
+     * @expectedExceptionMessage Unable to parse response body into XML: String could not be parsed as XML
+     */
+    public function testParsesXmlResponseException()
     {
-        $this->expectException(RuntimeException::class);
+        $response = new Response(200, [], '<abc');
 
-        $response = new Response(200, [], 'FooBar');
+        ResponseParser::xml($response);
+    }
 
-        ResponseParser::json($response);
+    /**
+     * Based on https://github.com/guzzle/guzzle3/blob/v3.9.3/tests/Guzzle/Tests/Http/Message/ResponseTest.php#L662-L676
+     */
+    public function testPreventsComplexExternalEntities()
+    {
+        $xml = '<?xml version="1.0"?><!DOCTYPE scan[<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=ResponseTest.php">]><scan>&test;</scan>';
+        $response = new Response(200, [], $xml);
+        $oldCwd = getcwd();
+        chdir(__DIR__);
+        try {
+            $xml = ResponseParser::xml($response);
+            chdir($oldCwd);
+            $this->markTestIncomplete('Did not throw the expected exception! XML resolved as: ' . $xml->asXML());
+        } catch (\Exception $e) {
+            chdir($oldCwd);
+        }
     }
 
 }