From: James Britt Date: 2008-08-24T06:06:54+09:00 Subject: Re: [ANN] DoS vulnerability in REXML Christopher Dicely wrote: > On Sat, Aug 23, 2008 at 9:28 AM, James Britt wrote: >> Shugo Maeda wrote: >>> Hello, >>> >>> DoS vulenerabilitiy has been discovered in REXML. >>> You can also read this report at the following URL. >>> >>> * >>> >>> >>> = DoS vulnerability in REXML >>> >>> There is a DoS vulnerability in the REXML library used by Rails to >>> parse incoming XML requests. >> To be clear: This is a Rails issue, not a general REXML issue? >> >> The post suggests that Rails uses a different REXML library than what ships >> with the standard Ruby distro, and mentions no other Ruby framework (Web or >> otherwise). > > > But the versions it lists affected are Ruby versions, not Rails > versions. The original post said referred to "the REXML library used by Rails", not the REXML library included with Ruby's standard distro. And were this an issue with a standard Ruby lib, and not a customized Rails version, I would have expected an actual patch for the REXML source so that all code using REXML is patched. > Since REXML is part of the standard library, and particular > Ruby (not Rails) versions are affected, I think the part of the > description that focuses on the risk to Rails is most likely > misguided, and that its a general REXML, not Rails, problem. > > Testing the example file in irb on Ruby 1.8.6 on WinXP, without > loading any rails-related libraries, it seems to grab all the > processor resources it can and just hang (this occurs when you access > the only text node of the root element, not on the initial parse, > because until you do that, REXML doesn't try to expand the entities), > so I think tha clinches that its Ruby, not Rails. Then the original post is misleading in emphasizing Rails. Lots of people use REXML on the Web outside of Rails, so the effect on Rails is incidental to the real problem and should have been omitted for clarity. -- James Britt www.happycamperstudios.com - Wicked Cool Coding www.jamesbritt.com - Playing with Better Toys www.ruby-doc.org - Ruby Help & Documentation www.rubystuff.com - The Ruby Store for Ruby Stuff