------art_2382_23547468.1219917215491
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi,

Moved from ruby-dev.

The attached patch is to fix the DoS vulnerability in REXML.  It's based on
the monkey patch by Michael Koziarski, but there are some considerations
to apply it.

* The name of the API to set the expansion limit.
  (Is REXML::Document#entity_expansion_limit K?)
* Whether to provide an API to set the expansion limit per REXML::Document
  instance.
* Whether to raise more specific exception than RuntimeError.
* Whether to provide an API to reject XML documents with doctype.
  (see also http://java.sun.com/j2se/1.5.0/docs/guide/xml/jaxp/JAXP-Compatibility_150.html#JAXP_security)

Any comment?

-- 
Shugo Maeda

------art_2382_23547468.1219917215491
Content-Type: text/x-diff; name=entity_expansion_limit.diff
Content-Transfer-Encoding: base64
X-Attachment-Id: f_fkf6s7ki0
Content-Disposition: attachment; filename=entity_expansion_limit.diff

SW5kZXg6IGxpYi9yZXhtbC9kb2N1bWVudC5yYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBsaWIvcmV4bWwvZG9j
dW1lbnQucmIJKHJldmlzaW9uIDE4ODM0KQorKysgbGliL3JleG1sL2RvY3VtZW50LnJiCSh3b3Jr
aW5nIGNvcHkpCkBAIC0zMiw2ICszMiw3IEBACiAJICAjIEBwYXJhbSBjb250ZXh0IGlmIHN1cHBs
aWVkLCBjb250YWlucyB0aGUgY29udGV4dCBvZiB0aGUgZG9jdW1lbnQ7CiAJICAjIHRoaXMgc2hv
dWxkIGJlIGEgSGFzaC4KIAkJZGVmIGluaXRpYWxpemUoIHNvdXJjZSA9IG5pbCwgY29udGV4dCA9
IHt9ICkKKyAgICAgIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50ID0gMAogCQkJc3VwZXIoKQogCQkJ
QGNvbnRleHQgPSBjb250ZXh0CiAJCQlyZXR1cm4gaWYgc291cmNlLm5pbD8KQEAgLTIwMCw2ICsy
MDEsMjcgQEAKIAkJCVBhcnNlcnM6OlN0cmVhbVBhcnNlci5uZXcoIHNvdXJjZSwgbGlzdGVuZXIg
KS5wYXJzZQogCQllbmQKIAorICAgIEBAZW50aXR5X2V4cGFuc2lvbl9saW1pdCA9IDEwXzAwMAor
CisgICAgIyBTZXQgdGhlIGVudGl0eSBleHBhbnNpb24gbGltaXQuIEJ5IGRlZnVhbHQgdGhlIGxp
bWl0IGlzIHNldCB0byAxMDAwMC4KKyAgICBkZWYgRG9jdW1lbnQ6OmVudGl0eV9leHBhbnNpb25f
bGltaXQ9KCB2YWwgKQorICAgICAgQEBlbnRpdHlfZXhwYW5zaW9uX2xpbWl0ID0gdmFsCisgICAg
ZW5kCisKKyAgICAjIEdldCB0aGUgZW50aXR5IGV4cGFuc2lvbiBsaW1pdC4gQnkgZGVmdWFsdCB0
aGUgbGltaXQgaXMgc2V0IHRvIDEwMDAwLgorICAgIGRlZiBEb2N1bWVudDo6ZW50aXR5X2V4cGFu
c2lvbl9saW1pdAorICAgICAgcmV0dXJuIEBAZW50aXR5X2V4cGFuc2lvbl9saW1pdAorICAgIGVu
ZAorCisgICAgYXR0cl9yZWFkZXIgOmVudGl0eV9leHBhbnNpb25fY291bnQKKyAgICAKKyAgICBk
ZWYgcmVjb3JkX2VudGl0eV9leHBhbnNpb24KKyAgICAgIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50
ICs9IDEKKyAgICAgIGlmIEBlbnRpdHlfZXhwYW5zaW9uX2NvdW50ID4gQEBlbnRpdHlfZXhwYW5z
aW9uX2xpbWl0CisgICAgICAgIHJhaXNlICJudW1iZXIgb2YgZW50aXR5IGV4cGFuc2lvbnMgZXhj
ZWVkZWQsIHByb2Nlc3NpbmcgYWJvcnRlZC4iCisgICAgICBlbmQKKyAgICBlbmQKKwogCQlwcml2
YXRlCiAJCWRlZiBidWlsZCggc291cmNlICkKICAgICAgIFBhcnNlcnM6OlRyZWVQYXJzZXIubmV3
KCBzb3VyY2UsIHNlbGYgKS5wYXJzZQpJbmRleDogbGliL3JleG1sL2VudGl0eS5yYgo9PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09Ci0tLSBsaWIvcmV4bWwvZW50aXR5LnJiCShyZXZpc2lvbiAxODgzNCkKKysrIGxpYi9yZXht
bC9lbnRpdHkucmIJKHdvcmtpbmcgY29weSkKQEAgLTczLDYgKzczLDcgQEAKIAkJIyBhbGwgZW50
aXRpZXMgLS0gYm90aCAlZW50OyBhbmQgJmVudDsgZW50aXRpZXMuICBUaGlzIGRpZmZlcnMgZnJv
bQogCQkjICt2YWx1ZSgpKyBpbiB0aGF0ICt2YWx1ZSsgb25seSByZXBsYWNlcyAlZW50OyBlbnRp
dGllcy4KIAkJZGVmIHVubm9ybWFsaXplZAorICAgICAgZG9jdW1lbnQucmVjb3JkX2VudGl0eV9l
eHBhbnNpb24KIAkJCXYgPSB2YWx1ZSgpCiAJCQlyZXR1cm4gbmlsIGlmIHYubmlsPwogCQkJQHVu
bm9ybWFsaXplZCA9IFRleHQ6OnVubm9ybWFsaXplKHYsIHBhcmVudCkKSW5kZXg6IHRlc3QvcmV4
bWwvdGVzdF9kb2N1bWVudC5yYgo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSB0ZXN0L3JleG1sL3Rlc3RfZG9jdW1l
bnQucmIJKHJldmlzaW9uIDApCisrKyB0ZXN0L3JleG1sL3Rlc3RfZG9jdW1lbnQucmIJKHJldmlz
aW9uIDApCkBAIC0wLDAgKzEsNDIgQEAKK3JlcXVpcmUgInJleG1sL2RvY3VtZW50IgorcmVxdWly
ZSAidGVzdC91bml0IgorCitjbGFzcyBSRVhNTDo6VGVzdERvY3VtZW50IDwgVGVzdDo6VW5pdDo6
VGVzdENhc2UKKyAgZGVmIHRlc3RfbmV3CisgICAgZG9jID0gUkVYTUw6OkRvY3VtZW50Lm5ldyg8
PEVPRikKKzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04Ij8+Cis8bWVzc2FnZT5I
ZWxsbyB3b3JsZCE8L21lc3NhZ2U+CitFT0YKKyAgICBhc3NlcnRfZXF1YWwoIkhlbGxvIHdvcmxk
ISIsIGRvYy5yb290LmNoaWxkcmVuLmZpcnN0LnZhbHVlKQorICBlbmQKKworICBYTUxfV0lUSF9O
RVNURURfRU5USVRZID0gPDxFT0YKKzw/eG1sIHZlcnNpb249IjEuMCIgZW5jb2Rpbmc9IlVURi04
Ij8+Cis8IURPQ1RZUEUgbWVtYmVyIFsKKyAgPCFFTlRJVFkgYSAiJmI7JmI7JmI7JmI7JmI7JmI7
JmI7JmI7JmI7JmI7Ij4KKyAgPCFFTlRJVFkgYiAiJmM7JmM7JmM7JmM7JmM7JmM7JmM7JmM7JmM7
JmM7Ij4KKyAgPCFFTlRJVFkgYyAiJmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7JmQ7Ij4KKyAg
PCFFTlRJVFkgZCAiJmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7JmU7Ij4KKyAgPCFFTlRJVFkg
ZSAiJmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7JmY7Ij4KKyAgPCFFTlRJVFkgZiAiJmc7Jmc7
Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Jmc7Ij4KKyAgPCFFTlRJVFkgZyAieHh4eHh4eHh4eHh4eHh4
eHh4eHh4eHh4eHh4eHh4Ij4KK10+Cis8bWVtYmVyPgorJmE7Cis8L21lbWJlcj4KK0VPRgorCisg
IGRlZiB0ZXN0X2VudGl0eV9leHBhbnNpb25fbGltaXQKKyAgICBkb2MgPSBSRVhNTDo6RG9jdW1l
bnQubmV3KFhNTF9XSVRIX05FU1RFRF9FTlRJVFkpCisgICAgYXNzZXJ0X3JhaXNlKFJ1bnRpbWVF
cnJvcikgZG8KKyAgICAgIGRvYy5yb290LmNoaWxkcmVuLmZpcnN0LnZhbHVlCisgICAgZW5kCisg
ICAgUkVYTUw6OkRvY3VtZW50LmVudGl0eV9leHBhbnNpb25fbGltaXQgPSAxMDAKKyAgICBhc3Nl
cnRfZXF1YWwoMTAwLCBSRVhNTDo6RG9jdW1lbnQuZW50aXR5X2V4cGFuc2lvbl9saW1pdCkKKyAg
ICBkb2MgPSBSRVhNTDo6RG9jdW1lbnQubmV3KFhNTF9XSVRIX05FU1RFRF9FTlRJVFkpCisgICAg
YXNzZXJ0X3JhaXNlKFJ1bnRpbWVFcnJvcikgZG8KKyAgICAgIGRvYy5yb290LmNoaWxkcmVuLmZp
cnN0LnZhbHVlCisgICAgZW5kCisgICAgYXNzZXJ0X2VxdWFsKDEwMSwgZG9jLmVudGl0eV9leHBh
bnNpb25fY291bnQpCisgIGVuZAorZW5kCg------art_2382_23547468.1219917215491--