XOM API for Processing XML with Java

[Dave Pawson <dave.pawson AT gmail.com>]

You can't please all the people all the time?
If I run some tiny server with 256K memory running java...
vs my online server with 256Gb.....

Perhaps if the limit is configurable Elliotte?

regards

On 3 May 2014 01:04, Elliotte Rusty Harold <elharo AT ibiblio.org> wrote:
> I've been thinking about adding some (optional) protection to XOM against
> the billion laughs and similar attacks. My rough plan of attack is to allow
> the client to set an approximate maximum size on the Builder. The internal
> SAX handler would keep a running count of approximate memory used as it
> creates objects. If that limit is exceeded, it throws an exception and
> discards the document. Any thoughts?
>
> One question is whether I try to count memory or characters used. The goal
> here is not to be exact, just to prevent malicious documents from expanding
> too much.
>
> A second thing I'm thinking about are XXE attacks. Here my plans are a
> little hazier. I could just give the Builder an option to abort if any
> external entities are detected but that seems too coarse-grained. In some
> scenarios you want to allow file access but restrict http. In others the
> reverse is true. And some times it may be acceptable to load entities from
> some domains but not others. Would anyone like to propose an API for
> configuring such details?
>
> --
> Elliotte Rusty Harold
> elharo AT ibiblio.org
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest



-- 
Dave Pawson
XSLT XSL-FO FAQ.
Docbook FAQ.
http://www.dpawson.co.uk