Please expose XML_SetBillionLaughsAttackProtectionActivationThreshold() functionality

[dlangille]

Hello,

I have a use case where I'm hitting the Billion Laughs limits with valid (and trusted) files. I was able to find a fix by patching expat. I opened an issue and provided my temp fix. The issue contains a sample function and shows how to reproduce the issue.

Please provide a way for XML-Parser users to invoke the XML_SetBillionLaughsAttackProtectionActivationThreshold function. That would let me set the value at run-time instead of hardcoding a new default-value at build time.

Thank you.

[hartwork]

@toddr happy new year! What do you think?

[toddr]

I'm open to a PR on this.

[hartwork]

@toddr I'm not fluent in Perl unfortunately. CPython stdlib has the same problem and is written in C (and Python), upstream issue python/cpython#90949 . I may be able to help them at some point, but I cannot do Perl.

[hartwork]

Small update: I'm promoting this issue now via the upstream change log file and the full list of security API functions missing from XML::Parser is:

• XML_SetBillionLaughsAttackProtectionActivationThreshold
• XML_SetBillionLaughsAttackProtectionMaximumAmplification
• XML_SetReparseDeferralEnabled

[hartwork]

FYI starting with Expat 2.7.2, there are two new API functions more related to both security and amplification:

• XML_SetAllocTrackerActivationThreshold
• XML_SetAllocTrackerMaximumAmplification