Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve entities defined in DOCTYPE recursively. #161

Merged
merged 2 commits into from Feb 26, 2021
Merged

Resolve entities defined in DOCTYPE recursively. #161

merged 2 commits into from Feb 26, 2021

Conversation

jgm
Copy link
Contributor

@jgm jgm commented Feb 25, 2021

This puts a limit on recursion depth (10) to avoid loops and other attacks.

Fixes #103.

Entity expansion loops are detected and avoided.

In addition, there is a limit on the length of an
entity expansion (to guard against attacks like the
billion laughs attack). This can be adjusted using
the new exported field `psEntityExpansionSizeLimit`
on ParseSettings. By default it is set at 8192.

Add tests, including a test for the billion laughs attack.
@jgm
Copy link
Contributor Author

jgm commented Feb 26, 2021

OK, I've changed this, adding a new adjustable parameter for the max size of any single entity expansion, and better code for avoiding loops. I've also added more tests.

Copy link
Collaborator

@k0ral k0ral left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay in reviewing.

xml-conduit/src/Text/XML/Stream/Parse.hs Outdated Show resolved Hide resolved
xml-conduit/src/Text/XML/Stream/Parse.hs Outdated Show resolved Hide resolved
xml-conduit/src/Text/XML/Stream/Parse.hs Outdated Show resolved Hide resolved
xml-conduit/src/Text/XML/Stream/Parse.hs Outdated Show resolved Hide resolved
xml-conduit/test/unit.hs Show resolved Hide resolved
@k0ral k0ral merged commit 4be1021 into snoyberg:master Feb 26, 2021
1 check was pending
@k0ral
Copy link
Collaborator

k0ral commented Feb 26, 2021

Squashed and merged, thank you !

@jgm
Copy link
Contributor Author

jgm commented Feb 26, 2021

Great, thank you for the quick merge. When do you expect a new release of xml-conduit? I am looking forward to switching skylighting from HXT, but this awaits these fixes.

@k0ral
Copy link
Collaborator

k0ral commented Feb 27, 2021

Released as 1.9.1.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

DTD ENTITY definitions can themselves have entities in them
2 participants