http://simonwillison.net/2008-08-23T11:11:13+00:00Simon Willison2008-08-23T11:11:13+00:002008-08-23T11:11:13+00:00https://simonwillison.net/2008/Aug/23/dos/#atom-tag

<p><strong><a href="http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/">DoS vulnerability in REXML</a></strong></p> Ruby’s REXML library is susceptible to the “billion laughs” denial of service attack where recursively nested entities expand a single entitity reference to a billion characters (kind of like the exploding zip file attack). Rails applications that process user-supplied XML should apply the monkey-patch ASAP; a proper gem update is forthcoming. <p>Tags: <a href="https://simonwillison.net/tags/billionlaughs">billionlaughs</a>, <a href="https://simonwillison.net/tags/denial-of-service">denial-of-service</a>, <a href="https://simonwillison.net/tags/rails">rails</a>, <a href="https://simonwillison.net/tags/rexml">rexml</a>, <a href="https://simonwillison.net/tags/ruby">ruby</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/xml">xml</a></p>