mw: fix transform middleware regression with XML

This was a crash in the mxj library concerning invalid input from a
reader, as it would not properly error and stop. We did not hit this
before in 2.3.x as we used a []byte, not an io.Reader.

The upstream issue is clbanning/mxj#38, fixed
back in February.

Add a regression test and bump the vendored version.

Fixes #1122.

mw_transform_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"io/ioutil"
+	"strings"
 	"testing"
 	"text/template"
 
@@ -31,3 +32,16 @@ func TestTransformNonAscii(t *testing.T) {
 		t.Fatalf("wanted body %q, got %q", want, got)
 	}
 }
+
+func TestTransformXMLCrash(t *testing.T) {
+	// mxj.NewMapXmlReader used to take forever and crash the
+	// process by eating up all the memory.
+	in := strings.NewReader("")
+	r := testReq(t, "GET", "/", in)
+	tmeta := &TransformSpec{}
+	tmeta.TemplateData.Input = apidef.RequestXML
+	tmeta.Template = template.Must(template.New("blob").Parse(""))
+	if err := transformBody(r, tmeta, false); err == nil {
+		t.Fatalf("wanted error, got nil")
+	}
+}