/*
* Copyright (c) 2014-2026 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/
import { describe, it } from 'node:test'
import assert from 'node:assert/strict'
import { parseXmlString } from '../../lib/xml'
void describe('xml', () => {
void it('should parse a simple XML string', async () => {
const xml = 'hello'
const result = await parseXmlString(xml)
assert.match(result, /hello<\/root>/)
})
void it('should expand internal entities', async () => {
const xml = `
]>
&hello;`
const result = await parseXmlString(xml)
assert.match(result, /world<\/root>/)
})
void it('should throw error on malformed XML', async () => {
const xml = 'unclosed'
await assert.rejects(async () => {
await parseXmlString(xml)
})
})
void it('should timeout on entity expansion bomb', async () => {
const xml = `
]>
&lol9;`
// This might trigger either the libxml2 amplification protection or the VM timeout
await assert.rejects(async () => {
await parseXmlString(xml, 100) // 100ms timeout
}, /(Script execution timed out|Maximum entity amplification factor exceeded)/)
})
})