From: Christopher Dicely Date: 2008-08-24T03:00:18+09:00 Subject: Re: [ANN] DoS vulnerability in REXML On Sat, Aug 23, 2008 at 9:28 AM, James Britt wrote: > Shugo Maeda wrote: >> >> Hello, >> >> DoS vulenerabilitiy has been discovered in REXML. >> You can also read this report at the following URL. >> >> * >> >> >> = DoS vulnerability in REXML >> >> There is a DoS vulnerability in the REXML library used by Rails to >> parse incoming XML requests. > > To be clear: This is a Rails issue, not a general REXML issue? > > The post suggests that Rails uses a different REXML library than what ships > with the standard Ruby distro, and mentions no other Ruby framework (Web or > otherwise). But the versions it lists affected are Ruby versions, not Rails versions. Since REXML is part of the standard library, and particular Ruby (not Rails) versions are affected, I think the part of the description that focuses on the risk to Rails is most likely misguided, and that its a general REXML, not Rails, problem. Testing the example file in irb on Ruby 1.8.6 on WinXP, without loading any rails-related libraries, it seems to grab all the processor resources it can and just hang (this occurs when you access the only text node of the root element, not on the initial parse, because until you do that, REXML doesn't try to expand the entities), so I think tha clinches that its Ruby, not Rails.