test: reproduce reported security issues for #1061

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

.github/workflows/nodejs.yml

@@ -119,6 +119,10 @@ jobs:
           - ubuntu-latest
           - macos-13 # macos-latest has issues with node14
           - windows-latest
+        includes:
+          - #
+            node-version: 20
+            os: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout

tests/integration/Validation.XmlValidator.test.js

@@ -99,5 +99,47 @@ describe('Validation.XmlValidator', () => {
       const validationError = await validator.validate(input)
       assert.strictEqual(validationError, null)
     })
+
+    it('is not vulnerable to advisories/GHSA-mjr4-7xg5-pfvh', async  () => {
+      /* report:
+      see https://github.com/advisories/GHSA-mjr4-7xg5-pfvh
+      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
+      */
+      const validator = new XmlValidator(version)
+      /* POC payload:
+      see https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/#poc
+       */
+      const input = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE note
+[
+<!ENTITY writer "` + 'A'.repeat(0x1234) + `">
+]>
+<from>&writer;</from>
+`;
+      const validationError = await validator.validate(input)
+      // expected to not crash ...
+      assert.strictEqual(validationError, null)
+    })
+
+    it('is not vulnerable to advisories/GHSA-78h3-pg4x-j8cv', async  () => {
+      /* report:
+      see https://github.com/advisories/GHSA-78h3-pg4x-j8cv
+      see https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1061
+      */
+      const validator = new XmlValidator(version)
+      /* POC payload:
+      see https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/#poc
+      */
+      const input = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE note
+[
+<!ENTITY writer PUBLIC "` + "A".repeat(8) + "B".repeat(8) + "C".repeat(8) + "D".repeat(8) + "P".repeat(8) + `" "JFrog Security">
+]>
+<from>&writer;</from>
+`;
+      const validationError = await validator.validate(input)
+      // expected to not crash ...
+      assert.strictEqual(validationError, null)
+    })
   }))
 })