back

by gnabgib·4y ago·view on hn ↗
Many, many, tools/scanners will fall prey to XML, YAML and zip bombs because of the nature of the decoder. There's not a good reason why you're deliberately running a processor on these exploits unless you thought the file was safe (supply chain attack?), you made a mistake (set timeout=0), or want to make a point.

The conclusion is particularly egregious "This is how we - unexpectedly - saw an XML bomb in action. It was very interesting to explore a real-life popular application and find something like this". A deliberately crafted bomb, opened in a not-yet-popular preview isn't an unexpected or real-life situation. Maybe their analyzer helps, but this isn't convincing.

1 comments
Maybe i misunderstood, but I think the bug happened when they merely tried to view the contents of their XML bomb, presumably for legitimate purposes pertaining to their XML work, in the IDE. Triggering the bomb when the hostile XML is merely viewed through the text editor (as opposed to loading it as trusted configuration input) should probably be considered a bug.