[
https://issues.apache.org/jira/browse/XERCESJ-1616?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tomas Kacer updated XERCESJ-1616:
---------------------------------
Attachment: xmlDosAttack2MB.zip
attached an xml file just 2 MB that takes several minutes before it fails.
> Extremly Slow XML declaration parsing
> --------------------------------------
>
> Key: XERCESJ-1616
> URL: https://issues.apache.org/jira/browse/XERCESJ-1616
> Project: Xerces2-J
> Issue Type: Bug
> Components: JAXP (javax.xml.parsers)
> Affects Versions: 2.11.0
> Reporter: Tomas Kacer
> Attachments: xmlDosAttack2MB.zip
>
>
> For specially crafted XML files (e.g. created by codenomicon test tool) with
> injected data in the XML declaration the parser spends too much time parsing
> the XML decl until it fails, due to its per byte/character processing here.
> MayReadChunks is not used here for some reason and it is horrible slow
> because of that and just hogs the single CPU core until it finally fails.
> Either xerces should be very strict what can be in the XML decl (as that is
> defined by DTD and should fail with the first character that doesn't match
> the DTD and not use generic parsing for those attributes until the whole
> attribute is parsed) or provide reasonable performance processing XML decl
> (e.g. enable mayReadChunks while processing the XML decl, not sure what
> sideeffects it could have, worked fine for my request when enabled before).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
