From: Michael Bommarito Date: Fri, 10 Jul 2026 11:07:01 +0000 (-0400) Subject: tests: cover line-break rejection in DNS TXT and SRV records X-Git-Tag: v12.6.0-rc1~41 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3cfc77963b512d809348fca07f97fe924fac9a05;p=thirdparty%2Flibvirt.git tests: cover line-break rejection in DNS TXT and SRV records Add negative tests that feed XML numeric character references for LF ( ) and CR ( ) into the DNS TXT value and SRV domain/target attributes, covering both the network XML parse path and the update API. Literal newlines are insufficient because XML parsers normalize raw attribute whitespace to spaces; the numeric references are what survive to the configuration emitter. CVE-2026-61477 Reviewed-by: Daniel P. Berrangé Signed-off-by: Michael Bommarito --- diff --git a/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml b/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml new file mode 100644 index 0000000000..13ed0408f4 --- /dev/null +++ b/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml @@ -0,0 +1 @@ + diff --git a/tests/networkxml2xmlupdatein/srv-record-target-newline.xml b/tests/networkxml2xmlupdatein/srv-record-target-newline.xml new file mode 100644 index 0000000000..f29385d0e1 --- /dev/null +++ b/tests/networkxml2xmlupdatein/srv-record-target-newline.xml @@ -0,0 +1 @@ + diff --git a/tests/networkxml2xmlupdatetest.c b/tests/networkxml2xmlupdatetest.c index b017922d94..35fdfed0ec 100644 --- a/tests/networkxml2xmlupdatetest.c +++ b/tests/networkxml2xmlupdatetest.c @@ -288,6 +288,10 @@ mymain(void) section = VIR_NETWORK_SECTION_DNS_TXT; + DO_TEST_FAIL("insert-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_ADD_FIRST); DO_TEST("insert-dns-txt-record", "dns-txt-record-snowman", "nat-network-dns-txt-record", @@ -311,6 +315,10 @@ mymain(void) "nat-network-dns-txt-record", "nat-network-dns-txt-modify-ok", VIR_NETWORK_UPDATE_COMMAND_MODIFY); + DO_TEST_FAIL("modify-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_MODIFY); DO_TEST_FAIL("modify-missing-dns-txt-record", "dns-txt-record-modify-fail", "nat-network-dns-txt-record", @@ -328,6 +336,10 @@ mymain(void) "nat-network", "nat-network-dns-srv-record", VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); + DO_TEST_FAIL("append-srv-record-target-newline", + "srv-record-target-newline", + "nat-network", + VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); DO_TEST_FAIL("add-existing-dns-srv-record", "srv-record", "nat-network-dns-srv-record", diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml new file mode 100644 index 0000000000..2a1a5e4a89 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml new file mode 100644 index 0000000000..f3f722ab16 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml new file mode 100644 index 0000000000..02408a1e36 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml @@ -0,0 +1,14 @@ + + default + 81ff0d90-c91e-6742-64da-4a736edb9a9b + + + + + + + + + + + diff --git a/tests/networkxmlconftest.c b/tests/networkxmlconftest.c index 40eb3ffdb4..c0d3886a69 100644 --- a/tests/networkxmlconftest.c +++ b/tests/networkxmlconftest.c @@ -323,7 +323,10 @@ mymain(void) DO_TEST("netboot-proxy-network"); DO_TEST("netboot-tftp"); DO_TEST("nat-network-dns-txt-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-txt-record-newline"); DO_TEST("nat-network-dns-srv-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-domain-newline"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-target-newline"); DO_TEST("nat-network-dns-srv-records"); DO_TEST("nat-network-dns-srv-record-minimal"); DO_TEST("nat-network-dns-hosts"); diff --git a/tests/virschematest.c b/tests/virschematest.c index 4faac8d976..fabe45b65d 100644 --- a/tests/virschematest.c +++ b/tests/virschematest.c @@ -301,9 +301,18 @@ static const struct testSchemaEntry schemaInterface[] = { { .dir = "tests/interfaceschemadata" }, }; +/* skip tests with completely broken XML */ +static const char *skip_networkxmlconfdata[] = { + "nat-network-dns-srv-record-domain-newline.xml", + "nat-network-dns-srv-record-target-newline.xml", + "nat-network-dns-txt-recor-record-newline.xml", + NULL, +}; + static const struct testSchemaEntry schemaNetwork[] = { { .dir = "src/network" }, - { .dir = "tests/networkxmlconfdata" }, + { .dir = "tests/networkxmlconfdata", + .skip = skip_networkxmlconfdata }, { .dir = "examples/xml/test/", .dirRegex = "testnet.*" }, { .dir = "tests/networkxml2xmlupdateout" },