326206 - XML parser chokes on extremely long attributes

Status: RESOLVED INCOMPLETE

(Core :: XML, defect)

Description

[Daniel Veditz [:dveditz]]

Spun off from bug 319846 comment 2

As seen in bug 319846 extremely long attributes can DoS the XML parser. Nearly every time I broke in the debugger I was in little2_scanAtts (xmltok_impl.c). It appeared that when the current 4K chunk was exhausted the parser would start over again on that attribute with the next chunk added, so O((n^2)/4k)

Although we can sanitize stored data as in bug 319846, we can't always sidestep this issue since someone could send us a malicious XML file. If compressed it wouldn't be impractical to send the million or so characters that would be required.

Comment 1

[Josh Aas]

Anyone interested in looking into this?

Comment 2

[Andrei Purice]

Hey Daniel,
Does this issue still occur for you or can it be closed?

Comment 3

[Daniel Veditz [:dveditz]]

I don't know: the expat project has fixed some DOS issues in the intervening years, but I can't find one mentioning attributes specifically. We'd have to create a test XML file with an attribute ~1M characters or more and see if we bog down.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

In the process of migrating remaining bugs to the new severity system, the severity for this bug cannot be automatically determined. Please retriage this bug using the new severity system.

Comment 5

[Andrew McCreight [:mccr8]]

Let's just close this for now and somebody can file a new issue if they come across a test case.