Billion laughs xml "bomb"

[zach-taylor]

trafficstars

Example here: https://en.wikipedia.org/wiki/Billion_laughs

[minimaxir]

That seems more like a specific script than a set of strings.

[ssokolow]

It's basically the XML equivalent of a forkbomb and it's part of a set of XML vulnerabilities which are very common because so many XML parsers don't include protection by default. (eg. the Python standard library is vulnerable and the docs say to use the defusedxml package from PyPI if you're parsing untrusted XML.)

https://docs.python.org/2/library/xml.html#xml-vulnerabilities

[zach-taylor]

Indeed! Microsoft Word (at least on Mac) crashes upon pasting the above example as plaintext.

[minimaxir]

A Word crash makes sense since the modern versions are XML-based.

Rethinking this.