wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-05 06:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Restrict XML file recursion depth to 200.

Browse source 
This resolves #2.
This commit is contained in:
wolfbeast 2017-06-15 16:38:41 +02:00 • committed by Roy Tam
commit 141ff75e6a
2 changed files with 17 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

14
parser/htmlparser/nsExpatDriver.cpp
View file

@ -338,6 +338,9 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsExpatDriver)
NS_IMPL_CYCLE_COLLECTION(nsExpatDriver, mSink, mExtendedSink) NS_IMPL_CYCLE_COLLECTION(nsExpatDriver, mSink, mExtendedSink)
// We store the tagdepth in a Uint8, so make sure the limit fits in a Uint8.
PR_STATIC_ASSERT(MAX_XML_TREE_DEPTH <= UINT8_MAX);
nsExpatDriver::nsExpatDriver() nsExpatDriver::nsExpatDriver()
: mExpatParser(nullptr), : mExpatParser(nullptr),
mInCData(false), mInCData(false),
@ -345,6 +348,7 @@ nsExpatDriver::nsExpatDriver()
mInExternalDTD(false), mInExternalDTD(false),
mMadeFinalCallToExpat(false), mMadeFinalCallToExpat(false),
mIsFinalChunk(false), mIsFinalChunk(false),
mTagDepth(0),
mInternalState(NS_OK), mInternalState(NS_OK),
mExpatBuffered(0), mExpatBuffered(0),
mCatalogData(nullptr), mCatalogData(nullptr),
@ -359,7 +363,7 @@ nsExpatDriver::~nsExpatDriver()
} }
} }
nsresult void
nsExpatDriver::HandleStartElement(const char16_t *aValue, nsExpatDriver::HandleStartElement(const char16_t *aValue,
const char16_t **aAtts) const char16_t **aAtts)
{ {
@ -377,13 +381,16 @@ nsExpatDriver::HandleStartElement(const char16_t *aValue,
} }
if (mSink) { if (mSink) {
if (++mTagDepth == MAX_XML_TREE_DEPTH) {
MaybeStopParser(NS_ERROR_HTMLPARSER_HIERARCHYTOODEEP);
return;
}
nsresult rv = mSink-> nsresult rv = mSink->
HandleStartElement(aValue, aAtts, attrArrayLength, HandleStartElement(aValue, aAtts, attrArrayLength,
XML_GetCurrentLineNumber(mExpatParser)); XML_GetCurrentLineNumber(mExpatParser));
MaybeStopParser(rv); MaybeStopParser(rv);
} }
return NS_OK;
} }
nsresult nsresult
@ -395,6 +402,7 @@ nsExpatDriver::HandleEndElement(const char16_t *aValue)
if (mSink && mInternalState != NS_ERROR_HTMLPARSER_STOPPARSING) { if (mSink && mInternalState != NS_ERROR_HTMLPARSER_STOPPARSING) {
nsresult rv = mSink->HandleEndElement(aValue); nsresult rv = mSink->HandleEndElement(aValue);
--mTagDepth;
MaybeStopParser(rv); MaybeStopParser(rv);
} }

7
parser/htmlparser/nsExpatDriver.h
View file

@ -16,6 +16,9 @@
#include "nsIParser.h" #include "nsIParser.h"
#include "nsCycleCollectionParticipant.h" #include "nsCycleCollectionParticipant.h"
// Tree depth limit for XML-based files (xml/svg/etc.)
#define MAX_XML_TREE_DEPTH 200
class nsIExpatSink; class nsIExpatSink;
class nsIExtendedExpatSink; class nsIExtendedExpatSink;
struct nsCatalogData; struct nsCatalogData;
@ -37,7 +40,7 @@ public:
const char16_t *aBase, const char16_t *aBase,
const char16_t *aSystemId, const char16_t *aSystemId,
const char16_t *aPublicId); const char16_t *aPublicId);
nsresult HandleStartElement(const char16_t *aName, const char16_t **aAtts); void HandleStartElement(const char16_t *aName, const char16_t **aAtts);
nsresult HandleEndElement(const char16_t *aName); nsresult HandleEndElement(const char16_t *aName);
nsresult HandleCharacterData(const char16_t *aCData, const uint32_t aLength); nsresult HandleCharacterData(const char16_t *aCData, const uint32_t aLength);
nsresult HandleComment(const char16_t *aName); nsresult HandleComment(const char16_t *aName);
@ -120,6 +123,8 @@ private:
// Necko // Necko
bool mIsFinalChunk; bool mIsFinalChunk;
uint8_t mTagDepth;
nsresult mInternalState; nsresult mInternalState;
// The length of the data in Expat's buffer (in number of PRUnichars). // The length of the data in Expat's buffer (in number of PRUnichars).