Re:Now Is the Perfect Time for an RSS Renaissance
by eropple on Monday April 23, 2018 @06:04PM
(#16907872)
Not to be flip, but if you're using a parser written by competent individuals post-2010 (really, post-2008), billion laughs is a nothing.
And that follows for most XML stuff. If you are getting most bloggable with your tech stack, yes, there are certainly risks to XML (also to YAML, also to JSON--and there are definitely JSON parsers that have had some capital-I Issues out there, and a good number of the popular ones also parse not-JSON too). That said, if you're using anything remotely mainstream you can feel reasonably secure against the sorts of attacks you are likely to see because, TBH, your RSS reader is just not that valuable a target. (Or, in my case--the podcast service I'm writing.)
The entire JSON spec is only about 3 pages long. (I don't know exactly how long because ECMA's webpage is down today!) I'm pretty confident that any popular JSON parser I use will abort correctly on bad JSON. There's no expansion or entities or escaping, so the parser is a pretty boring 1-to-1 translation. Give it a 1KB JSON file, and I'm going to get back a data structure that takes roughly 1KB.
XML is incredibly complicated. My operating system's XML parser has had XXE-related security bugs in the recent past -- that's OWASP bug#4, and there's a Wikipedia article about it. There's other possible attacks, like the "billion laughs attack". I'm very nervous about running an XML parser on untrusted content.