Add negative tests that feed XML numeric character references for LF ( ) and CR ( ) into the DNS TXT value and SRV domain/target attributes, covering both the network XML parse path and the update API. Literal newlines are insufficient because XML parsers normalize raw attribute whitespace to spaces; the numeric references are what survive to the configuration emitter. CVE-2026-61477 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> --- .../dns-txt-record-newline.xml | 1 + .../srv-record-target-newline.xml | 1 + tests/networkxml2xmlupdatetest.c | 12 ++++++++++++ .../nat-network-dns-srv-record-domain-newline.xml | 14 ++++++++++++++ .../nat-network-dns-srv-record-target-newline.xml | 14 ++++++++++++++ .../nat-network-dns-txt-record-newline.xml | 14 ++++++++++++++ tests/networkxmlconftest.c | 3 +++ 7 files changed, 59 insertions(+) create mode 100644 tests/networkxml2xmlupdatein/dns-txt-record-newline.xml create mode 100644 tests/networkxml2xmlupdatein/srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml create mode 100644 tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml diff --git a/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml b/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml new file mode 100644 index 0000000000..13ed0408f4 --- /dev/null +++ b/tests/networkxml2xmlupdatein/dns-txt-record-newline.xml @@ -0,0 +1 @@ +<txt name='example' value='example value dhcp-script=/tmp/payload'/> diff --git a/tests/networkxml2xmlupdatein/srv-record-target-newline.xml b/tests/networkxml2xmlupdatein/srv-record-target-newline.xml new file mode 100644 index 0000000000..f29385d0e1 --- /dev/null +++ b/tests/networkxml2xmlupdatein/srv-record-target-newline.xml @@ -0,0 +1 @@ +<srv service='ldap' protocol='tcp' target='server.example.com dhcp-script=/tmp/payload'/> diff --git a/tests/networkxml2xmlupdatetest.c b/tests/networkxml2xmlupdatetest.c index b017922d94..35fdfed0ec 100644 --- a/tests/networkxml2xmlupdatetest.c +++ b/tests/networkxml2xmlupdatetest.c @@ -288,6 +288,10 @@ mymain(void) section = VIR_NETWORK_SECTION_DNS_TXT; + DO_TEST_FAIL("insert-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_ADD_FIRST); DO_TEST("insert-dns-txt-record", "dns-txt-record-snowman", "nat-network-dns-txt-record", @@ -311,6 +315,10 @@ mymain(void) "nat-network-dns-txt-record", "nat-network-dns-txt-modify-ok", VIR_NETWORK_UPDATE_COMMAND_MODIFY); + DO_TEST_FAIL("modify-dns-txt-record-newline", + "dns-txt-record-newline", + "nat-network-dns-txt-record", + VIR_NETWORK_UPDATE_COMMAND_MODIFY); DO_TEST_FAIL("modify-missing-dns-txt-record", "dns-txt-record-modify-fail", "nat-network-dns-txt-record", @@ -328,6 +336,10 @@ mymain(void) "nat-network", "nat-network-dns-srv-record", VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); + DO_TEST_FAIL("append-srv-record-target-newline", + "srv-record-target-newline", + "nat-network", + VIR_NETWORK_UPDATE_COMMAND_ADD_LAST); DO_TEST_FAIL("add-existing-dns-srv-record", "srv-record", "nat-network-dns-srv-record", diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml new file mode 100644 index 0000000000..2a1a5e4a89 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-domain-newline.xml @@ -0,0 +1,14 @@ +<network> + <name>default</name> + <uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid> + <forward dev='eth1' mode='nat'/> + <bridge name='virbr0' stp='on' delay='0'/> + <dns> + <srv service='ldap' protocol='tcp' domain='example.com dhcp-script=/tmp/payload' target='server.example.com'/> + </dns> + <ip address='192.168.122.1' netmask='255.255.255.0'> + <dhcp> + <range start='192.168.122.2' end='192.168.122.254'/> + </dhcp> + </ip> +</network> diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml new file mode 100644 index 0000000000..f3f722ab16 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-target-newline.xml @@ -0,0 +1,14 @@ +<network> + <name>default</name> + <uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid> + <forward dev='eth1' mode='nat'/> + <bridge name='virbr0' stp='on' delay='0'/> + <dns> + <srv service='ldap' protocol='tcp' domain='example.com' target='server.example.com dhcp-script=/tmp/payload'/> + </dns> + <ip address='192.168.122.1' netmask='255.255.255.0'> + <dhcp> + <range start='192.168.122.2' end='192.168.122.254'/> + </dhcp> + </ip> +</network> diff --git a/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml new file mode 100644 index 0000000000..02408a1e36 --- /dev/null +++ b/tests/networkxmlconfdata/nat-network-dns-txt-record-newline.xml @@ -0,0 +1,14 @@ +<network> + <name>default</name> + <uuid>81ff0d90-c91e-6742-64da-4a736edb9a9b</uuid> + <forward dev='eth1' mode='nat'/> + <bridge name='virbr0' stp='on' delay='0'/> + <dns> + <txt name='example' value='example value dhcp-script=/tmp/payload'/> + </dns> + <ip address='192.168.122.1' netmask='255.255.255.0'> + <dhcp> + <range start='192.168.122.2' end='192.168.122.254'/> + </dhcp> + </ip> +</network> diff --git a/tests/networkxmlconftest.c b/tests/networkxmlconftest.c index 40eb3ffdb4..c0d3886a69 100644 --- a/tests/networkxmlconftest.c +++ b/tests/networkxmlconftest.c @@ -323,7 +323,10 @@ mymain(void) DO_TEST("netboot-proxy-network"); DO_TEST("netboot-tftp"); DO_TEST("nat-network-dns-txt-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-txt-record-newline"); DO_TEST("nat-network-dns-srv-record"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-domain-newline"); + DO_TEST_PARSE_ERROR("nat-network-dns-srv-record-target-newline"); DO_TEST("nat-network-dns-srv-records"); DO_TEST("nat-network-dns-srv-record-minimal"); DO_TEST("nat-network-dns-hosts"); -- 2.53.0