Skip to Content.
Sympa Menu

xom-interest - [XOM-interest] Memory Sizes

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Rusty Harold <elharo AT ibiblio.org>
  • To: XOM interest <xom-interest AT lists.ibiblio.org>
  • Subject: [XOM-interest] Memory Sizes
  • Date: Sun, 22 Jul 2018 09:03:38 -0400

Before the release of 1.2.11 I'm thinking about backing out the
experimental limits on document memory sizes; that is, billion laugh
protection.

As best I can tell this doesn't truly work. It will catch some
problems, but can be bypassed by a clever attacker. I'd rather not
provide a false sense of security, and I think this can be better
addressed at the parser level using techniques like
XMLConstants.FEATURE_SECURE_PROCESSING

Any thoughts?

--
Elliotte Rusty Harold
elharo AT ibiblio.org



  • [XOM-interest] Memory Sizes, Elliotte Rusty Harold, 07/22/2018

Archive powered by MHonArc 2.6.24.

Top of Page