|
2abb9033
|
2024-08-19T17:58:47
|
|
tests: Add fallback for glob()
Fix build on platforms without glob().
|
|
|
208f27f9
|
2024-06-15T19:13:08
|
|
include: Don't define ATTRIBUTE_UNUSED in public header
Stop polluting namespace with unprefixed names.
|
|
|
712a31ab
|
2024-06-10T23:06:13
|
|
parser: Deprecate most public struct members
This will probably cause many warnings in downstream code abusing
libxml2 internals, but we can always undeprecate some members later.
|
|
|
89743f8b
|
2024-06-11T11:34:48
|
|
test: Disable catalogs with xmlCatalogSetDefaults
Disable catalogs instead of tracking catalog allocations, simplifying
memory leak detection.
Also stop using xmlNoNetExternalEntityLoader.
|
|
|
65c65b65
|
2024-01-04T13:59:23
|
|
tests: Move away from global error handlers
|
|
|
5cb4b05c
|
2024-01-02T17:16:22
|
|
parser: Lower maximum entity nesting depth
Limit entity nesting depth to 20 or 40 with XML_PARSE_HUGE.
Change error code to XML_ERR_RESOURCE_LIMIT.
|
|
|
3874e5d0
|
2023-12-26T01:42:23
|
|
tests: Remove unneeded error formatting code
|
|
|
455c61d6
|
2023-11-23T15:59:41
|
|
Remove VMS support
This was last updated 10 years ago and is most likely broken.
|
|
|
aca37d8c
|
2023-11-20T15:20:37
|
|
parser: Only enable SAX2 if there are SAX2 element handlers
This reverts part of commit 235b15a5 for backward compatibility and
adds some comments trying to clarify the whole mess.
Fixes #623.
|
|
|
f92ea2cc
|
2023-11-18T14:36:41
|
|
tests: Fix build with older MSVC
Regressed in 9b5cce7a.
Fixes #620.
|
|
|
61034116
|
2023-10-24T15:02:36
|
|
error: Make more xmlError structs constant
Prepare for future changes, see 45470611.
|
|
|
9b5cce7a
|
2023-09-21T00:44:50
|
|
include: Remove more unnecessary includes
|
|
|
209516ac
|
2023-09-20T15:49:03
|
|
tests: Don't use deprecated symbols
|
|
|
5aff27ae
|
2023-08-08T15:21:25
|
|
parser: Optimize xmlLoadEntityContent
Load entity content via xmlParserInputBufferGrow, avoiding a copy.
This also fixes an entity size accounting error.
|
|
|
886bf4e6
|
2023-04-30T15:35:47
|
|
Stop calling xmlMemoryDump
This was used to check for memory leaks but could potentially create a
.memdump file. These days, there are better ways to check for memory
leaks.
|
|
|
3f69fc80
|
2023-03-08T13:58:49
|
|
parser: Tighten expansion limits
- Lower the amount of expansion which is always allowed from
10MB to 1MB.
- Lower the maximum amplification factor from 10 to 5.
- Lower the "fixed cost" from 50 to 20.
|
|
|
cfc036bd
|
2022-12-21T19:27:45
|
|
testrecurse: Test parameter entity accounting
|
|
|
106c4cdd
|
2022-12-21T17:05:54
|
|
testrecurse: Support multiple huge docs
|
|
|
079da5b2
|
2022-12-21T03:26:31
|
|
testrecurse: Add external entities to huge test
|
|
|
01bcb23d
|
2022-12-21T01:01:36
|
|
testrecurse: Add test cases for external entities
Add test cases for external general and parameter entities.
|
|
|
69aeff53
|
2022-12-20T22:33:28
|
|
testrecurse: Also test without entity substitution
|
|
|
4c7cb8f4
|
2022-12-20T22:42:24
|
|
testrecurse: Also test SAX parser
|
|
|
583cd2f6
|
2022-12-21T05:13:23
|
|
testrecurse: Start to test entity expansion stats
|
|
|
463bbeec
|
2022-12-19T18:39:45
|
|
entities: Rework entity amplification checks
This commit implements robust detection of entity amplification attacks,
better known as the "billion laughs" attack.
We now limit the size of the document after substitution of entities to
10 times the size before expansion. This guarantees linear behavior by
definition. There already was a similar check before, but the accounting
of "sizeentities" (size of external entities) and "sizeentcopy" (size of
all copies created by entity references) wasn't accurate.
We also need saturation arithmetic since we're historically limited to
"unsigned long" which is 32-bit on many platforms.
A maximum of 10 MB of substitutions is always allowed. This should make
use cases like DITA work which have caused problems in the past.
The old checks based on the number of entities were removed. This is
accounted for by adding a fixed cost to each entity reference.
Entity amplification checks are now enabled even if XML_PARSE_HUGE is
set. This option is mainly used to allow larger text nodes. Most users
were unaware that it also disabled entity expansion checks.
Some of the limits might be adjusted later. If this change turns out to
affect legitimate use cases, we can add a separate parser option to
disable the checks.
Fixes #294.
Fixes #345.
|
|
|
dd3569ea
|
2022-12-08T02:43:17
|
|
Remove XMLDECL macro from .c files
|
|
|
34a5a4a5
|
2022-11-22T15:40:51
|
|
tests: Remove unneeded #includes
|
|
|
5bffa33a
|
2022-09-02T05:03:03
|
|
Stop including sys/types.h
|
|
|
2489c1d0
|
2022-02-28T22:42:10
|
|
Remove useless __CYGWIN__ checks
From what I can tell, some really early Cygwin versions from around
1998-2000 used to erroneously define _WIN32. This was eventually fixed,
but these days, the `defined(_WIN32) && !defined(__CYGWIN__)` idiom is
unnecessary.
Now, we only check for __CYGWIN__ in xmlexports.h when deciding whether
to use __declspec.
|
|
2a350ee9
|
2019-09-30T17:04:54
|
|
Large batch of typo fixes
Closes #109.
|
|
|
8919885f
|
2019-01-01T16:30:38
|
|
Fix -Wformat-truncation warnings (GCC 8)
|
|
|
154824ee
|
2017-10-21T14:07:38
|
|
Fix unused variable warnings in testrecurse
|
|
c3b1d09b
|
2012-08-13T16:50:48
|
|
clean redefinition of {v}snprintf in C-source
as those from *config.h are preferable (e.g. win32config.h)
|
|
|
1f0453f7
|
2012-08-13T16:56:11
|
|
minimize use of HAVE_CONFIG_H
as build process for supported platforms provide "config.h" header file
|
|
b60e612e
|
2012-07-18T16:21:17
|
|
Small cleanup of unused variables in test
|
|
|
22030ef8
|
2012-05-23T15:52:45
|
|
Restore code for Windows compilation
Try to keep as close to rc1 but still allow the change from Roumen for
mingw
|
|
|
978ff224
|
2012-05-20T16:07:54
|
|
use mingw C99 compatible functions {v}snprintf instead those from MSVC runtime
|
|
0161e638
|
2008-08-28T15:36:32
|
|
completely different fix for the recursion detection based on entity
* parser.c include/libxml/parser.h: completely different fix for
the recursion detection based on entity density, big cleanups
in the entity parsing code too
* result/*.sax*: the parser should not ask for used defined versions
of the predefined entities
* testrecurse.c: automatic test for entity recursion checks
* Makefile.am: added testrecurse
* test/recurse/lol* test/recurse/good*: a first set of tests for
the recursion
Daniel
svn path=/trunk/; revision=3783
|