Re: [PATCH] Check hex or decimal entity for overflow
Jay Civelli via xml <[email protected]>
| Newsgroups | gmane.comp.gnome.lib.xml.general |
|---|---|
| Message-ID | <CAJ6=x6k7pKEH9aHqwiJLMi-jqA9zFRr9O6A_20hzZL83ghAsjQ@mail.gmail.com> |
On Tue, Jan 23, 2018 at 8:21 PM, Daniel Veillard <[email protected]> wrote: > On Mon, Jan 22, 2018 at 04:37:17PM +0100, Nick Wellnhofer wrote: > > On 09/01/2018 00:55, Joel Hockey wrote: > > > Updated patch with XML_ERR_INVALID_CHAR. > > > > Should be fixed with > > > > > > https://git.gnome.org/browse/libxml2/commit/?id=60dded12cbf1 > 705927803c5ed615a7a0132aebbd > > > > As noted previously, this only affects "recovery" mode. The commit > addresses > > And I repeatedly asked people to *not* use recover mode of the XML parser > which is not conformant to the XML spec, unless this is upon an explicit > recovery operation, not a default process. I *really* hope that chrome or > chromium is *not* using the recovery mode by default for XML parsing > in the browser. I guarantee nothing about the recovery mode in the long > term > and I already wrote that I would remove it from the parser if people were > abusing this option. > Chromium was using recover mode when parsing XML for some operations (extension related for example), but not when rendering XML. It was changed in https://chromium-review.googlesource.com/c/chromium/ src/+/879106 so the recover mode is not used anywhere in Chromium now. Jay XML is fairly tidy, we can't let the general usage diverge from the spec. > > Daniel > > > the issue at an earlier point in the parsing process and makes sure not > to > > return invalid entity content in recovery mode at all. > > > > Nick > > _______________________________________________ > > xml mailing list, project page http://xmlsoft.org/ > > [email protected] > > https://mail.gnome.org/mailman/listinfo/xml > > -- > Daniel Veillard | Red Hat Developers Tools > http://developer.redhat.com/ > [email protected] | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ > http://veillard.com/ | virtualization library http://libvirt.org/ > _______________________________________________ > xml mailing list, project page http://xmlsoft.org/ > [email protected] > https://mail.gnome.org/mailman/listinfo/xml > _______________________________________________ xml mailing list, project page http://xmlsoft.org/ [email protected] https://mail.gnome.org/mailman/listinfo/xml