/*
    * Licensed to the Apache Software Foundation (ASF) under one or more
    * contributor license agreements.  See the NOTICE file distributed with
    * this work for additional information regarding copyright ownership.
    * The ASF licenses this file to You under the Apache License, Version 2.0
    * (the "License"); you may not use this file except in compliance with
    * the License.  You may obtain a copy of the License at
    *
    *      https://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  package org.apache.commons.xml.secure;
  
  import static org.apache.commons.xml.secure.AttackTestSupport.LEAKED_MARKER;
  import static org.apache.commons.xml.secure.AttackTestSupport.resourceUrl;
  import static org.junit.jupiter.api.Assertions.assertEquals;
  import static org.junit.jupiter.api.Assertions.assertNull;
  import static org.junit.jupiter.api.Assumptions.assumeTrue;
  
  import javax.xml.XMLConstants;
  import javax.xml.parsers.SAXParser;
  import javax.xml.parsers.SAXParserFactory;
  
  import org.junit.jupiter.api.Tag;
  import org.junit.jupiter.api.Test;
  import org.xml.sax.Attributes;
  import org.xml.sax.InputSource;
  import org.xml.sax.XMLReader;
  import org.xml.sax.helpers.DefaultHandler;
  
  /**
   * Tests that a secure {@link SAXParserFactory} performing JAXP 1.2 XSD validation does not fetch an external schema named by an
   * {@code xsi:noNamespaceSchemaLocation} hint in the instance document.
   *
   * <p>
   * This is the SAX counterpart of {@link SchemaLocationDomTest}. The instance is an empty {@code <root/>} element; the referenced schema declares a default
   * {@code leak} attribute carrying {@link AttackTestSupport#LEAKED_MARKER}. A parser that fetches the schema augments the element's attributes with that default
   * (the permissive control observes it in {@link DefaultHandler#startElement}), while a secure parser resolves the schema reference to empty content instead.
   * Either the empty schema makes the validating parse fail, or the parse completes but the default attribute is never added to the element; either way, the
   * marker is never observed.
   * </p>
   *
   * <p>
   * The test runs only where the implementation supports JAXP 1.2 schema-language XSD validation (the stock JDK and external Xerces do; Android does not), so it
   * skips on parsers without it.
   * </p>
   */
  @Tag("sax")
  class SchemaLocationSaxTest {
  
      /**
       * Captures the root element's schema-defaulted {@code leak} attribute, the SAX-visible signal that the external schema was fetched.
       */
      private static final class LeakCapturingHandler extends DefaultHandler {
          private String leak;
  
          @Override
          public void startElement(final String uri, final String localName, final String qName, final Attributes attributes) {
              if ("root".equals(localName) || "root".equals(qName)) {
                  leak = attributes.getValue("leak");
              }
          }
      }
  
      /**
       * JAXP 1.2 property selecting the schema language used by {@link SAXParserFactory#setValidating(boolean)}.
       */
      private static final String SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage";
  
      private static final String INSTANCE = "schema-location-instance.xml";
  
      private static SAXParser newValidatingParser(final SAXParserFactory factory) throws Exception {
          factory.setNamespaceAware(true);
          factory.setValidating(true);
          final SAXParser parser = factory.newSAXParser();
          parser.setProperty(SCHEMA_LANGUAGE, XMLConstants.W3C_XML_SCHEMA_NS_URI);
          return parser;
      }
  
      private static void parse(final SAXParser parser, final DefaultHandler handler) throws Exception {
          // Drive the XMLReader directly rather than SAXParser.parse(InputSource, DefaultHandler): the latter calls reader.setEntityResolver(handler), which would
          // clobber the secure ignore-all resolver that external Xerces relies on to block the schemaLocation fetch. Reuse AttackTestSupport's shared strict
          // reporter as the error handler so a blocked fetch surfaces as a thrown exception rather than a silent recovery.
          final XMLReader reader = parser.getXMLReader();
          reader.setContentHandler(handler);
          AttackTestSupport.strictXMLReader(reader);
          reader.parse(new InputSource(resourceUrl(INSTANCE).toString()));
      }
  
      private static boolean supportsSchemaLanguage() {
          try {
              final SAXParserFactory factory = SAXParserFactory.newInstance();
              factory.setNamespaceAware(true);
             factory.setValidating(true);
             factory.newSAXParser().setProperty(SCHEMA_LANGUAGE, XMLConstants.W3C_XML_SCHEMA_NS_URI);
             return true;
         } catch (final Exception e) {
             return false;
         }
     }
 
     @Test
     void secureDoesNotFetchExternalSchema() throws Exception {
         assumeTrue(supportsSchemaLanguage(), "parser does not support JAXP 1.2 schema-language XSD validation");
         final SAXParser parser = newValidatingParser(SecureSAXParserFactory.newInstance());
         // The schemaLocation reference resolves to empty rather than being fetched. Either the empty schema fails the validating parse (acceptable), or the
         // parse completes but the schema's default leak attribute is never augmented onto the element. Either way the marker must not be observed.
         final LeakCapturingHandler handler = new LeakCapturingHandler();
         try {
             parse(parser, handler);
         } catch (final Exception blocked) {
             // Acceptable: the empty schema was rejected at parse time, so nothing was fetched or augmented.
         }
         assertNull(handler.leak, "Secured parse must not augment the external schema's default attribute onto the element.");
     }
 
     @Test
     void unconfiguredFetchesExternalSchema() throws Exception {
         assumeTrue(supportsSchemaLanguage(), "parser does not support JAXP 1.2 schema-language XSD validation");
         final SAXParserFactory factory = SAXParserFactory.newInstance();
         factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);
         final SAXParser parser = newValidatingParser(factory);
         // Positive control: without securing the external schema is fetched and its default attribute is augmented onto the root element.
         final LeakCapturingHandler handler = new LeakCapturingHandler();
         parse(parser, handler);
         assertEquals(LEAKED_MARKER, handler.leak,
                 "Permissive parse should have fetched the external schema and augmented its default attribute onto the element.");
     }
 }