You are viewing a plain text version of this content. The canonical link for it is here.
Posted to j-dev@xerces.apache.org by "Tomas Kacer (JIRA)" <xe...@xml.apache.org> on 2013/07/19 09:12:49 UTC
[jira] [Updated] (XERCESJ-1616) Extremly Slow XML declaration
parsing
[ https://issues.apache.org/jira/browse/XERCESJ-1616?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tomas Kacer updated XERCESJ-1616:
---------------------------------
Attachment: invalidversionValue.zip
example of long value in version
> Extremly Slow XML declaration parsing
> --------------------------------------
>
> Key: XERCESJ-1616
> URL: https://issues.apache.org/jira/browse/XERCESJ-1616
> Project: Xerces2-J
> Issue Type: Bug
> Components: JAXP (javax.xml.parsers)
> Affects Versions: 2.11.0
> Reporter: Tomas Kacer
> Attachments: invalidversionValue.zip, xmlDosAttack2MB.zip
>
>
> For specially crafted XML files (e.g. created by codenomicon test tool) with injected data in the XML declaration the parser spends too much time parsing the XML decl until it fails, due to its per byte/character processing here. MayReadChunks is not used here for some reason and it is horrible slow because of that and just hogs the single CPU core until it finally fails.
> Either xerces should be very strict what can be in the XML decl (as that is defined by DTD and should fail with the first character that doesn't match the DTD and not use generic parsing for those attributes until the whole attribute is parsed) or provide reasonable performance processing XML decl (e.g. enable mayReadChunks while processing the XML decl, not sure what sideeffects it could have, worked fine for my request when enabled before).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: j-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: j-dev-help@xerces.apache.org