[
https://issues.apache.org/jira/browse/XERCESJ-1616?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13713399#comment-13713399
]
Tomas Kacer commented on XERCESJ-1616:
--------------------------------------
looks like something was checked in rev 1499506, that would solve the uploaded
request. Still something should be done about the values of those valid
attributes (e.g. mayReadChunks improves that too, while rev. 1499506 not) and
if long value is provided there it takes long to parse it before it fails.
> Extremly Slow XML declaration parsing
> --------------------------------------
>
> Key: XERCESJ-1616
> URL: https://issues.apache.org/jira/browse/XERCESJ-1616
> Project: Xerces2-J
> Issue Type: Bug
> Components: JAXP (javax.xml.parsers)
> Affects Versions: 2.11.0
> Reporter: Tomas Kacer
> Attachments: invalidversionValue.zip, xmlDosAttack2MB.zip
>
>
> For specially crafted XML files (e.g. created by codenomicon test tool) with
> injected data in the XML declaration the parser spends too much time parsing
> the XML decl until it fails, due to its per byte/character processing here.
> MayReadChunks is not used here for some reason and it is horrible slow
> because of that and just hogs the single CPU core until it finally fails.
> Either xerces should be very strict what can be in the XML decl (as that is
> defined by DTD and should fail with the first character that doesn't match
> the DTD and not use generic parsing for those attributes until the whole
> attribute is parsed) or provide reasonable performance processing XML decl
> (e.g. enable mayReadChunks while processing the XML decl, not sure what
> sideeffects it could have, worked fine for my request when enabled before).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
