Mitigate Billion Laughs vulnerability

[angelozerr]

Billion Laughs attack vulnerability

Fixes redhat-developer/vscode-xml#476

Signed-off-by: azerr [email protected]

[angelozerr]

This PR should fix the redhat-developer/vscode-xml#476 issue but I need

• to write tests
• try to report the error (because as it's a fatal error it breaks the validation without reporting the error, why?)

[fbricon]

I can see the error

[angelozerr]

I can see the error

My issue was with Eclipse IDE. Now it works I select the entity which causes the problem.

[datho7561]

You can still freeze the language server if you do the following:

1. Open the document
2. Comment out the definition of &lol; in the DOCTYPE
3. Uncomment the definition of &lol;
4. If you attempt to revalidate, it the language server will be unresponsive, with no error messages on the output

[rgrunber]

I'm seeing similar behaviour. The patch works when resolving entities is enabled. When one disables it, the CPU still goes to 100% for the process.

Suspending the thread that seems to be spinning generally yields :

Daemon Thread [ForkJoinPool.commonPool-worker-3] (Suspended)	
	XMLEntityManager.startEntity(String, boolean) line: not available	
	XMLNSDocumentScannerImpl(XMLDocumentFragmentScannerImpl).scanEntityReference() line: not available	
	XMLNSDocumentScannerImpl$NSContentDispatcher(XMLDocumentFragmentScannerImpl$FragmentContentDispatcher).dispatch(boolean) line: not available	
	XMLNSDocumentScannerImpl(XMLDocumentFragmentScannerImpl).scanDocument(boolean) line: not available	
	LSPXMLParserConfiguration(XML11Configuration).parse(boolean) line: not available	
	LSPXMLParserConfiguration(XML11Configuration).parse(XMLInputSource) line: not available	
	LSPSAXParser(XMLParser).parse(XMLInputSource) line: not available	
	LSPSAXParser(AbstractSAXParser).parse(InputSource) line: not available	
	XMLValidator.parseXML(String, String, SAXParser) line: 293	
	XMLValidator.doDiagnostics(DOMDocument, XMLEntityResolver, List<Diagnostic>, XMLValidationSettings, ContentModelManager, CancelChecker) line: 123	
	ContentModelDiagnosticsParticipant.doDiagnostics(DOMDocument, List<Diagnostic>, XMLValidationSettings, CancelChecker) line: 50	
	XMLDiagnostics.doExtensionsDiagnostics(DOMDocument, List<Diagnostic>, XMLValidationSettings, CancelChecker) line: 64	
	XMLDiagnostics.doDiagnostics(DOMDocument, XMLValidationSettings, CancelChecker) line: 46	
	XMLLanguageService.doDiagnostics(DOMDocument, XMLValidationSettings, CancelChecker) line: 162	
	XMLLanguageService.publishDiagnostics(DOMDocument, Consumer<PublishDiagnosticsParams>, Consumer<TextDocument>, XMLValidationSettings, CancelChecker) line: 171	
	XMLTextDocumentService.validate(DOMDocument) line: 521	
	XMLTextDocumentService.lambda$triggerValidationFor$26(DOMDocument) line: 514	
	0x0000000800c9eab0.accept(Object) line: not available	
	CompletableFuture$UniAccept<T>.tryFire(int) line: 714	
	CompletableFuture$UniAccept<T>(CompletableFuture$Completion).exec() line: 479	
	CompletableFuture$UniAccept<T>(ForkJoinTask<V>).doExec() line: 295	
	ForkJoinPool$WorkQueue.topLevelExec(ForkJoinTask<?>, WorkQueue, int) line: 1016	
	ForkJoinPool.scan(ForkJoinPool$WorkQueue, int) line: 1665	
	ForkJoinPool.runWorker(ForkJoinPool$WorkQueue) line: 1598	
	ForkJoinWorkerThread.run() line: 183	

I was also able to reproduce this a few times without this patch, even when I could clearly see that entity resolution was being passed in as false.

[angelozerr]

I'm seeing similar behaviour. The patch works when resolving entities is enabled. When one disables it, the CPU still goes to 100% for the process.

Good catch! It should work now.

@datho7561 could you tell me if it is working with your usecase plase.

[datho7561]

This class is not used