search

bluebird75 / luaunit

LuaUnit is a popular unit-testing framework for Lua, with an interface typical of xUnit libraries (Python unittest, Junit, NUnit, ...). It supports several output formats (Text, TAP, JUnit, ...) to be used directly or work with Continuous Integration platforms (Jenkins, Maven, ...).
Other
565 stars 136 forks source link

Strings are not properly escaped in JUnit XML reports #163

Open generalmimon opened 1 month ago

generalmimon commented 1 month ago

Reproduction code:

test_reproducer.lua

local lu = require('luaunit')

function test_str_compare_null_byte()
    local actual   = "q\000\000\002w\000"
    local expected = "q\000\000\002w\000\000"

    lu.assertEquals(actual, expected)
end

os.exit( lu.LuaUnit.run() )
$ lua test_reproducer.lua --output junit --name report | cat --show-nonprinting
# XML output to report.xml
# Started on 07/25/24 16:34:54
# Starting test: test_str_compare_null_byte
#   Failure:  test_reproducer.lua:7: expected: "q^@^@^Bw^@^@"
#   actual: "q^@^@^Bw^@"
# Ran 1 tests in 0.002 seconds, 0 successes, 1 failure

The problem is that the JUnit XML reports will also (like the console output) contain these characters unescaped, resulting in invalid XML that the XML parsers I've tried refuse to read:

$ cat --show-nonprinting report.xml
<?xml version="1.0" encoding="UTF-8" ?>
<testsuites>
    <testsuite name="LuaUnit" id="00001" package="" hostname="localhost" tests="1" timestamp="2024-07-25T16:36:05" time="0.003" errors="0" failures="1" skipped="0">
        <properties>
            <property name="Lua Version" value="Lua 5.3"/>
            <property name="LuaUnit Version" value="3.4"/>
        </properties>
        <testcase classname="[TestFunctions]" name="test_str_compare_null_byte" time="0.002">
            <failure type="test_reproducer.lua:7: expected: &quot;q^@^@^Bw^@^@&quot;
actual: &quot;q^@^@^Bw^@&quot;">
                <![CDATA[stack traceback:
    test_reproducer.lua:7: in function 'test_str_compare_null_byte']]></failure>
        </testcase>
    <system-out/>
    <system-err/>
    </testsuite>
</testsuites>

I tried: