/[Apache-SVN]
ViewVC logotype

Revision 781403


Jump to revision: Previous Next
Author: jorton
Date: Wed Jun 3 14:26:19 2009 UTC (15 years, 10 months ago)
Changed paths: 3
Log Message:
Prevent "billion laughs" attack against expat:

* xml/apr_xml.c (entity_declaration, default_handler): Add new handlers
  for expat 2.x and 1.x respectively.
  (apr_xml_parser_create): Install handler to prevent expansion of
  internal entities with expat 1.x, and to fail on an entity
  declaration with expat 2.x.

* test/testxml.c (create_dummy_file, dump_xml): Test that predefined
  entities are expanded.
  (test_billion_laughs): New test case.


Changed paths

Path Details
Directoryapr/apr/trunk/test/data/billion-laughs.xml added
Directoryapr/apr/trunk/test/testxml.c modified , text changed
Directoryapr/apr/trunk/xml/apr_xml.c modified , text changed

infrastructure at apache.org
ViewVC Help
Powered by ViewVC 1.1.26