pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Michael Paquier <michael@paquier.xyz>
To: Dmitry Koval <d.koval@postgrespro.ru>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18274: Error 'invalid XML content'
Date: Thu, 25 Jan 2024 13:37:22 +0900
Message-ID: <ZbHlgrPLtBZyr_QW@paquier.xyz> (raw)
In-Reply-To: <ZacYXgM9A_CSLpD8@paquier.xyz>
References: <18274-98d16bc03520665f@postgresql.org>
	<1616257.1704651529@sss.pgh.pa.us>
	<5588db01-45be-48ff-b158-85f789bc502c@postgrespro.ru>
	<1314313.1705259848@sss.pgh.pa.us>
	<0eea123f-388a-41ea-9df3-d4606cf9ed8d@postgrespro.ru>
	<ZaRvbaQ8V9uGxXGD@paquier.xyz>
	<35ef78f9-8958-4225-ae7e-aead71b0feed@postgrespro.ru>
	<ZaZI4WAHZ67ZHq7p@paquier.xyz>
	<24e7412a-890c-46e3-b17d-addc39ff813f@postgrespro.ru>
	<ZacYXgM9A_CSLpD8@paquier.xyz>

On Wed, Jan 17, 2024 at 08:59:26AM +0900, Michael Paquier wrote:
> This one had better be done first because it is required by your
> original issue, and that's what could make the buildfarm shaky.
> 
> I have checked the other XML calls in the tree and did not spot
> anything else that ought to be changed, so I have extracted this stuff
> from your v2 and applied it on HEAD.  Let's see how it goes.

The security team has discussed 2197d06224a1 after a report from
coverity regarding the effects that issues like [1] would create in
the backend, and concluded that this patch should be reverted because
this could cause the backend to waste plently of CPU and/or memory
even if the application applied checks on the size of the data given
in input, and libxml2 does not offer guarantees that input limits are 
respected under XML_PARSE_HUGE.

So I am planning to do do so in the next 24 hours.  Note that this
does not impact 65c5864d7fac, as XML_PARSE_NOENT is an immediate
substitute of xmlSubstituteEntitiesDefault().

[1]: https://en.wikipedia.org/wiki/Billion_laughs_attack
--
Michael

Attachments:

  [application/pgp-signature] signature.asc (832B, ../ZbHlgrPLtBZyr_QW@paquier.xyz/2-signature.asc)
  download

view thread (16+ messages)  latest in thread

Message-ID: <ZbHlgrPLtBZyr_QW@paquier.xyz>
Permalink:  ../ZbHlgrPLtBZyr_QW@paquier.xyz/
Also on:    postgresql.org/message-id/ZbHlgrPLtBZyr_QW@paquier.xyz

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: michael@paquier.xyz, d.koval@postgrespro.ru, pgsql-bugs@lists.postgresql.org
  Subject: Re: BUG #18274: Error 'invalid XML content'
  In-Reply-To: <ZbHlgrPLtBZyr_QW@paquier.xyz>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox