diff options
-rw-r--r-- | ChangeLog | 8 | ||||
-rw-r--r-- | lib/rexml/document.rb | 12 | ||||
-rw-r--r-- | lib/rexml/text.rb | 40 | ||||
-rw-r--r-- | test/rexml/test_entity.rb | 18 |
4 files changed, 63 insertions, 15 deletions
@@ -1,3 +1,11 @@ +Fri Feb 22 18:31:46 2013 Aaron Patterson <aaron@tenderlovemaking.com> + + * lib/rexml/document.rb (REXML::Document.entity_expansion_text_limit): + new attribute to read/write entity expansion text limit. the default + limit is 10Kb. + + * lib/rexml/text.rb (REXML::Text.unnormalize): check above attribute. + Fri Feb 22 17:36:23 2013 NARUSE, Yui <naruse@ruby-lang.org> * test/test_rbconfig.rb (TestRbConfig): fix r39372. diff --git a/lib/rexml/document.rb b/lib/rexml/document.rb index f9fdbdaab3..c5280374ca 100644 --- a/lib/rexml/document.rb +++ b/lib/rexml/document.rb @@ -255,6 +255,18 @@ module REXML return @@entity_expansion_limit end + @@entity_expansion_text_limit = 10_240 + + # Set the entity expansion limit. By default the limit is set to 10240. + def Document::entity_expansion_text_limit=( val ) + @@entity_expansion_text_limit = val + end + + # Get the entity expansion limit. By default the limit is set to 10000. + def Document::entity_expansion_text_limit + return @@entity_expansion_text_limit + end + attr_reader :entity_expansion_count def record_entity_expansion diff --git a/lib/rexml/text.rb b/lib/rexml/text.rb index 6623c0c03b..878d13b8e8 100644 --- a/lib/rexml/text.rb +++ b/lib/rexml/text.rb @@ -380,25 +380,35 @@ module REXML # Unescapes all possible entities def Text::unnormalize( string, doctype=nil, filter=nil, illegal=nil ) + sum = 0 string.gsub( /\r\n?/, "\n" ).gsub( REFERENCE ) { - ref = $& - if ref[1] == ?# - if ref[2] == ?x - [ref[3...-1].to_i(16)].pack('U*') - else - [ref[2...-1].to_i].pack('U*') - end - elsif ref == '&' - '&' - elsif filter and filter.include?( ref[1...-1] ) - ref - elsif doctype - doctype.entity( ref[1...-1] ) or ref + s = Text.expand($&, doctype, filter) + if sum + s.bytesize > Document.entity_expansion_text_limit + raise "entity expansion has grown too large" else - entity_value = DocType::DEFAULT_ENTITIES[ ref[1...-1] ] - entity_value ? entity_value.value : ref + sum += s.bytesize end + s } end + + def Text.expand(ref, doctype, filter) + if ref[1] == ?# + if ref[2] == ?x + [ref[3...-1].to_i(16)].pack('U*') + else + [ref[2...-1].to_i].pack('U*') + end + elsif ref == '&' + '&' + elsif filter and filter.include?( ref[1...-1] ) + ref + elsif doctype + doctype.entity( ref[1...-1] ) or ref + else + entity_value = DocType::DEFAULT_ENTITIES[ ref[1...-1] ] + entity_value ? entity_value.value : ref + end + end end end diff --git a/test/rexml/test_entity.rb b/test/rexml/test_entity.rb index e6d6f29007..5900fac7a8 100644 --- a/test/rexml/test_entity.rb +++ b/test/rexml/test_entity.rb @@ -104,6 +104,24 @@ class EntityTester < Test::Unit::TestCase assert_equal source, out end + def test_entity_string_limit + template = '<!DOCTYPE bomb [ <!ENTITY a "^" > ]> <bomb>$</bomb>' + len = 5120 # 5k per entity + template.sub!(/\^/, "B" * len) + + # 10k is OK + entities = '&a;' * 2 # 5k entity * 2 = 10k + xmldoc = REXML::Document.new(template.sub(/\$/, entities)) + assert_equal(len * 2, xmldoc.root.text.bytesize) + + # above 10k explodes + entities = '&a;' * 3 # 5k entity * 2 = 15k + xmldoc = REXML::Document.new(template.sub(/\$/, entities)) + assert_raises(RuntimeError) do + xmldoc.root.text + end + end + def test_raw source = '<!DOCTYPE foo [ <!ENTITY ent "replace"> |