mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
* lib/rexml/entity.rb: keep the entity size within the limitation.
reported by Willis Vandevanter <will@silentrobots.com> and patched by nahi. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@48161 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
parent
e45b215fdd
commit
9cdd297a29
4 changed files with 55 additions and 0 deletions
|
@ -1,3 +1,9 @@
|
||||||
|
Mon Oct 27 20:13:37 2014 NAKAMURA Usaku <usa@ruby-lang.org>
|
||||||
|
|
||||||
|
* lib/rexml/entity.rb: keep the entity size within the limitation.
|
||||||
|
reported by Willis Vandevanter <will@silentrobots.com> and
|
||||||
|
patched by nahi.
|
||||||
|
|
||||||
Mon Oct 27 17:17:24 2014 Nobuyoshi Nakada <nobu@ruby-lang.org>
|
Mon Oct 27 17:17:24 2014 Nobuyoshi Nakada <nobu@ruby-lang.org>
|
||||||
|
|
||||||
* proc.c (method_proc): the receiver of binding from method should
|
* proc.c (method_proc): the receiver of binding from method should
|
||||||
|
|
|
@ -138,8 +138,14 @@ module REXML
|
||||||
matches = @value.scan(PEREFERENCE_RE)
|
matches = @value.scan(PEREFERENCE_RE)
|
||||||
rv = @value.clone
|
rv = @value.clone
|
||||||
if @parent
|
if @parent
|
||||||
|
sum = 0
|
||||||
matches.each do |entity_reference|
|
matches.each do |entity_reference|
|
||||||
entity_value = @parent.entity( entity_reference[0] )
|
entity_value = @parent.entity( entity_reference[0] )
|
||||||
|
if sum + entity_value.bytesize > Security.entity_expansion_text_limit
|
||||||
|
raise "entity expansion has grown too large"
|
||||||
|
else
|
||||||
|
sum += entity_value.bytesize
|
||||||
|
end
|
||||||
rv.gsub!( /%#{entity_reference.join};/um, entity_value )
|
rv.gsub!( /%#{entity_reference.join};/um, entity_value )
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -46,6 +46,20 @@ EOF
|
||||||
<member>
|
<member>
|
||||||
&a;
|
&a;
|
||||||
</member>
|
</member>
|
||||||
|
EOF
|
||||||
|
|
||||||
|
XML_WITH_NESTED_PARAMETER_ENTITY = <<EOF
|
||||||
|
<!DOCTYPE root [
|
||||||
|
<!ENTITY % a "BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.">
|
||||||
|
<!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;">
|
||||||
|
<!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;">
|
||||||
|
<!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;">
|
||||||
|
<!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;">
|
||||||
|
<!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;">
|
||||||
|
<!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;">
|
||||||
|
<!ENTITY test "test %g;">
|
||||||
|
]>
|
||||||
|
<cd></cd>
|
||||||
EOF
|
EOF
|
||||||
|
|
||||||
XML_WITH_4_ENTITY_EXPANSION = <<EOF
|
XML_WITH_4_ENTITY_EXPANSION = <<EOF
|
||||||
|
@ -86,6 +100,19 @@ EOF
|
||||||
REXML::Security.entity_expansion_limit = 10000
|
REXML::Security.entity_expansion_limit = 10000
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def test_entity_expansion_limit_for_parameter_entity
|
||||||
|
assert_raise(REXML::ParseException) do
|
||||||
|
REXML::Document.new(XML_WITH_NESTED_PARAMETER_ENTITY)
|
||||||
|
end
|
||||||
|
REXML::Security.entity_expansion_limit = 100
|
||||||
|
assert_equal(100, REXML::Security.entity_expansion_limit)
|
||||||
|
assert_raise(REXML::ParseException) do
|
||||||
|
REXML::Document.new(XML_WITH_NESTED_PARAMETER_ENTITY)
|
||||||
|
end
|
||||||
|
ensure
|
||||||
|
REXML::Security.entity_expansion_limit = 10000
|
||||||
|
end
|
||||||
|
|
||||||
def test_tag_in_cdata_with_not_ascii_only_but_ascii8bit_encoding_source
|
def test_tag_in_cdata_with_not_ascii_only_but_ascii8bit_encoding_source
|
||||||
tag = "<b>...</b>"
|
tag = "<b>...</b>"
|
||||||
message = "こんにちは、世界!" # Hello world! in Japanese
|
message = "こんにちは、世界!" # Hello world! in Japanese
|
||||||
|
|
|
@ -123,6 +123,22 @@ module REXMLTests
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
def test_entity_string_limit_for_parameter_entity
|
||||||
|
template = '<!DOCTYPE bomb [ <!ENTITY % a "^" > <!ENTITY bomb "$" > ]><root/>'
|
||||||
|
len = 5120 # 5k per entity
|
||||||
|
template.sub!(/\^/, "B" * len)
|
||||||
|
|
||||||
|
# 10k is OK
|
||||||
|
entities = '%a;' * 2 # 5k entity * 2 = 10k
|
||||||
|
REXML::Document.new(template.sub(/\$/, entities))
|
||||||
|
|
||||||
|
# above 10k explodes
|
||||||
|
entities = '%a;' * 3 # 5k entity * 2 = 15k
|
||||||
|
assert_raises(REXML::ParseException) do
|
||||||
|
REXML::Document.new(template.sub(/\$/, entities))
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
def test_raw
|
def test_raw
|
||||||
source = '<!DOCTYPE foo [
|
source = '<!DOCTYPE foo [
|
||||||
<!ENTITY ent "replace">
|
<!ENTITY ent "replace">
|
||||||
|
|
Loading…
Add table
Reference in a new issue