From: Urabe Shyouhei <shyouhei@...>
Date: 2008-08-24T04:21:04+09:00
Subject: Re: [ANN] DoS vulnerability in REXML

Want to name someone evil?  I'd vote this is an issue of XML itself. 
REXML is just doing what it is asked to do.  The problem is, it's (by
design) unclear how much resources are required to parse an XML
document, until we actually parse that document.

So, in fact this problem can happen without REXML, or even without
Ruby.  If you're using other XML parser, be sure that engine can handle
this issue correctly.


Christopher Dicely wrote:
> On Sat, Aug 23, 2008 at 9:28 AM, James Britt <james.britt@gmail.com> wrote:
>   
>> Shugo Maeda wrote:
>>     
>>> Hello,
>>>
>>> DoS vulenerabilitiy has been discovered in REXML.
>>> You can also read this report at the following URL.
>>>
>>> *
>>> <URL:http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/>
>>>
>>> = DoS vulnerability in REXML
>>>
>>> There is a DoS vulnerability in the REXML library used by Rails to
>>> parse incoming XML requests.
>>>       
>> To be clear: This is a Rails issue, not a general REXML issue?
>>
>> The post suggests that Rails uses a different REXML library  than what ships
>> with the standard Ruby distro, and mentions no other Ruby framework (Web or
>> otherwise).
>>     
>
>
> But the versions it lists affected are Ruby versions, not Rails
> versions. Since REXML is part of the standard library, and particular
> Ruby (not Rails) versions are affected, I think the part of the
> description that focuses on the risk to Rails is most likely
> misguided, and that its a general REXML, not Rails, problem.
>
> Testing the example file in irb on Ruby 1.8.6 on WinXP, without
> loading any rails-related libraries, it seems to grab all the
> processor resources it can and just hang (this occurs when you access
> the only text node of the root element, not on the initial parse,
> because until you do that, REXML doesn't try to expand the entities),
> so I think tha clinches that its Ruby, not Rails.
>