From: Shugo Maeda Date: 2008-08-25T22:41:00+09:00 Subject: [ruby-dev:35962] Re: [ruby-list:45386] Re: [ANN] REXMLのDoS脆弱性 ------=_Part_104460_27677743.1219671914592 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit Content-Disposition: inline 前田です。 2008/08/25 21:30 Shugo Maeda : >> (1) メソッドを追加するクラス・メソッド名はこのままでよいでしょうか。 >> (2) インスタンス単位で指定できるようにする必要はないでしょうか。 >> >> (1)について問題なければ、(2)については後で追加でもよいかもしれません。 > > もう一点、上限に引っかかった時に発生する例外がRuntimeErrorでいいかどうか > というのがありました。 > > raise "Number of entity expansions exceeded, processing aborted." > > ちなみに、REXMLで定義している例外は以下の二つですが、RuntimeErrorを > raiseしている部分も多いようです。 > > * REXML::ParseException > * REXML::Validation::ValidationException とりあえず、外部的なインタフェイスはmonkey patchからあまり変えない方向で trunkに適用してみました。 # trunkの方が1.8より3倍くらい速いですね。 -- Shugo Maeda ------=_Part_104460_27677743.1219671914592 Content-Type: text/x-diff; name=entity_expansion_limit.diff Content-Transfer-Encoding: base64 X-Attachment-Id: f_fkb53erl0 Content-Disposition: attachment; filename=entity_expansion_limit.diff SW5kZXg6IGxpYi9yZXhtbC9kb2N1bWVudC5yYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBsaWIvcmV4bWwvZG9j dW1lbnQucmIJKHJldmlzaW9uIDE4ODM0KQorKysgbGliL3JleG1sL2RvY3VtZW50LnJiCSh3b3Jr aW5nIGNvcHkpCkBAIC0zMiw2ICszMiw3IEBACiAJICAjIEBwYXJhbSBjb250ZXh0IGlmIHN1cHBs aWVkLCBjb250YWlucyB0aGUgY29udGV4dCBvZiB0aGUgZG9jdW1lbnQ7CiAJICAjIHRoaXMgc2hv dWxkIGJlIGEgSGFzaC4KIAkJZGVmIGluaXRpYWxpemUoIHNvdXJjZSA9IG5pbCwgY29udGV4dCA9 IHt9ICkKKyAgICAgIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50ID0gMAogCQkJc3VwZXIoKQogCQkJ QGNvbnRleHQgPSBjb250ZXh0CiAJCQlyZXR1cm4gaWYgc291cmNlLm5pbD8KQEAgLTIwMCw2ICsy MDEsMjcgQEAKIAkJCVBhcnNlcnM6OlN0cmVhbVBhcnNlci5uZXcoIHNvdXJjZSwgbGlzdGVuZXIg KS5wYXJzZQogCQllbmQKIAorICAgIEBAZW50aXR5X2V4cGFuc2lvbl9saW1pdCA9IDEwXzAwMAor CisgICAgIyBTZXQgdGhlIGVudGl0eSBleHBhbnNpb24gbGltaXQuIEJ5IGRlZnVhbHQgdGhlIGxp bWl0IGlzIHNldCB0byAxMDAwMC4KKyAgICBkZWYgRG9jdW1lbnQ6OmVudGl0eV9leHBhbnNpb25f bGltaXQ9KCB2YWwgKQorICAgICAgQEBlbnRpdHlfZXhwYW5zaW9uX2xpbWl0ID0gdmFsCisgICAg ZW5kCisKKyAgICAjIEdldCB0aGUgZW50aXR5IGV4cGFuc2lvbiBsaW1pdC4gQnkgZGVmdWFsdCB0 aGUgbGltaXQgaXMgc2V0IHRvIDEwMDAwLgorICAgIGRlZiBEb2N1bWVudDo6ZW50aXR5X2V4cGFu c2lvbl9saW1pdAorICAgICAgcmV0dXJuIEBAZW50aXR5X2V4cGFuc2lvbl9saW1pdAorICAgIGVu ZAorCisgICAgYXR0cl9yZWFkZXIgOmVudGl0eV9leHBhbnNpb25fY291bnQKKyAgICAKKyAgICBk ZWYgcmVjb3JkX2VudGl0eV9leHBhbnNpb24KKyAgICAgIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50 ICs9IDEKKyAgICAgIGlmIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50ID4gQEBlbnRpdHlfZXhwYW5z aW9uX2xpbWl0CisgICAgICAgIHJhaXNlICJudW1iZXIgb2YgZW50aXR5IGV4cGFuc2lvbnMgZXhj ZWVkZWQsIHByb2Nlc3NpbmcgYWJvcnRlZC4iCisgICAgICBlbmQKKyAgICBlbmQKKwogCQlwcml2 YXRlCiAJCWRlZiBidWlsZCggc291cmNlICkKICAgICAgIFBhcnNlcnM6OlRyZWVQYXJzZXIubmV3 KCBzb3VyY2UsIHNlbGYgKS5wYXJzZQpJbmRleDogbGliL3JleG1sL2VudGl0eS5yYgo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBsaWIvcmV4bWwvZW50aXR5LnJiCShyZXZpc2lvbiAxODgzNCkKKysrIGxpYi9yZXht bC9lbnRpdHkucmIJKHdvcmtpbmcgY29weSkKQEAgLTczLDYgKzczLDcgQEAKIAkJIyBhbGwgZW50 aXRpZXMgLS0gYm90aCAlZW50OyBhbmQgJmVudDsgZW50aXRpZXMuICBUaGlzIGRpZmZlcnMgZnJv bQogCQkjICt2YWx1ZSgpKyBpbiB0aGF0ICt2YWx1ZSsgb25seSByZXBsYWNlcyAlZW50OyBlbnRp dGllcy4KIAkJZGVmIHVubm9ybWFsaXplZAorICAgICAgZG9jdW1lbnQucmVjb3JkX2VudGl0eV9l eHBhbnNpb24KIAkJCXYgPSB2YWx1ZSgpCiAJCQlyZXR1cm4gbmlsIGlmIHYubmlsPwogCQkJQHVu bm9ybWFsaXplZCA9IFRleHQ6OnVubm9ybWFsaXplKHYsIHBhcmVudCkKSW5kZXg6IHRlc3QvcmV4 bWwvdGVzdF9kb2N1bWVudC5yYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSB0ZXN0L3JleG1sL3Rlc3RfZG9jdW1l bnQucmIJKHJldmlzaW9uIDApCisrKyB0ZXN0L3JleG1sL3Rlc3RfZG9jdW1lbnQucmIJKHJldmlz aW9uIDApCkBAIC0wLDAgKzEsNDIgQEAKK3JlcXVpcmUgInJleG1sL2RvY3VtZW50IgorcmVxdWly ZSAidGVzdC91bml0IgorCitjbGFzcyBSRVhNTDo6VGVzdERvY3VtZW50IDwgVGVzdDo6VW5pdDo6 VGVzdENhc2UKKyAgZGVmIHRlc3RfbmV3CisgICAgZG9jID0gUkVYTUw6OkRvY3VtZW50Lm5ldyg8 PEVPRikKKzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+Cis8bWVzc2FnZT5I ZWxsbyB3b3JsZCE8L21lc3NhZ2U+CitFT0YKKyAgICBhc3NlcnRfZXF1YWwoIkhlbGxvIHdvcmxk ISIsIGRvYy5yb290LmNoaWxkcmVuLmZpcnN0LnZhbHVlKQorICBlbmQKKworICBYTUxfV0lUSF9O RVNURURfRU5USVRZID0gPDxFT0YKKzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04 Ij8+Cis8IURPQ1RZUEUgbWVtYmVyIFsKKyAgPCFFTlRJVFkgYSAiJmI7JmI7JmI7JmI7JmI7JmI7 JmI7JmI7JmI7JmI7Ij4KKyAgPCFFTlRJVFkgYiAiJmM7JmM7JmM7JmM7JmM7JmM7JmM7JmM7JmM7 JmM7Ij4KKyAgPCFFTlRJVFkgYyAiJmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7Ij4KKyAg PCFFTlRJVFkgZCAiJmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7Ij4KKyAgPCFFTlRJVFkg ZSAiJmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7Ij4KKyAgPCFFTlRJVFkgZiAiJmc7Jmc7 Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Ij4KKyAgPCFFTlRJVFkgZyAieHh4eHh4eHh4eHh4eHh4 eHh4eHh4eHh4eHh4eHh4Ij4KK10+Cis8bWVtYmVyPgorJmE7Cis8L21lbWJlcj4KK0VPRgorCisg IGRlZiB0ZXN0X2VudGl0eV9leHBhbnNpb25fbGltaXQKKyAgICBkb2MgPSBSRVhNTDo6RG9jdW1l bnQubmV3KFhNTF9XSVRIX05FU1RFRF9FTlRJVFkpCisgICAgYXNzZXJ0X3JhaXNlKFJ1bnRpbWVF cnJvcikgZG8KKyAgICAgIGRvYy5yb290LmNoaWxkcmVuLmZpcnN0LnZhbHVlCisgICAgZW5kCisg ICAgUkVYTUw6OkRvY3VtZW50LmVudGl0eV9leHBhbnNpb25fbGltaXQgPSAxMDAKKyAgICBhc3Nl cnRfZXF1YWwoMTAwLCBSRVhNTDo6RG9jdW1lbnQuZW50aXR5X2V4cGFuc2lvbl9saW1pdCkKKyAg ICBkb2MgPSBSRVhNTDo6RG9jdW1lbnQubmV3KFhNTF9XSVRIX05FU1RFRF9FTlRJVFkpCisgICAg YXNzZXJ0X3JhaXNlKFJ1bnRpbWVFcnJvcikgZG8KKyAgICAgIGRvYy5yb290LmNoaWxkcmVuLmZp cnN0LnZhbHVlCisgICAgZW5kCisgICAgYXNzZXJ0X2VxdWFsKDEwMSwgZG9jLmVudGl0eV9leHBh bnNpb25fY291bnQpCisgIGVuZAorZW5kCg== ------=_Part_104460_27677743.1219671914592--