@@ -825,12 +825,14 @@ def start_element(name, _):
825
825
826
826
class AttackProtectionTest (unittest .TestCase ):
827
827
828
- def billion_laughs (self , ncols , nrows , text = '.' , indent = ' ' ):
829
- """Create a billion laugh payload.
828
+ def exponential_expansion_payload (self , ncols , nrows , text = '.' ):
829
+ """Create a billion laughs attack payload.
830
830
831
831
Be careful: the number of total items is pow(n, k), thereby
832
832
requiring at least pow(ncols, nrows) * sizeof(text) memory!
833
833
"""
834
+ # 'indent' affects the peak amplification factor and allocation
835
+ indent = ' ' * 2
834
836
body = textwrap .indent ('\n ' .join (
835
837
f'<!ENTITY row{ i + 1 } "{ f"&row{ i } ;" * ncols } ">'
836
838
for i in range (nrows )
@@ -847,9 +849,9 @@ def billion_laughs(self, ncols, nrows, text='.', indent=' '):
847
849
848
850
def test_set_alloc_tracker_maximum_amplification (self ):
849
851
# On WASI, the maximum amplification factor of the payload may differ,
850
- # so we craft a payload that is likely to yield an allocation factor
852
+ # so we craft a payload that is likely to yield an amplification factor
851
853
# way larger than 1.0 and way smaller than 10^5.
852
- payload = self .billion_laughs (1 , 2 )
854
+ payload = self .exponential_expansion_payload (1 , 2 )
853
855
854
856
p = expat .ParserCreate ()
855
857
# Unconditionally enable maximum amplification factor.
@@ -859,7 +861,7 @@ def test_set_alloc_tracker_maximum_amplification(self):
859
861
msg = r"out of memory: line \d+, column \d+"
860
862
self .assertRaisesRegex (expat .ExpatError , msg , p .Parse , payload )
861
863
862
- # # Re-create a parser as the current parser is now in an error state.
864
+ # Re-create a parser as the current parser is now in an error state.
863
865
p = expat .ParserCreate ()
864
866
# Unconditionally enable maximum amplification factor.
865
867
p .SetAllocTrackerActivationThreshold (0 )
@@ -880,11 +882,11 @@ def test_set_alloc_tracker_maximum_amplification_invalid_args(self):
880
882
self .assertRaisesRegex (expat .ExpatError , msg , fsub , 1.0 )
881
883
882
884
def test_set_alloc_tracker_activation_threshold (self ):
883
- # Run the test with EXPAT_MALLOC_DEBUG=2 to detect those constants.
885
+ # Run the test with EXPAT_MALLOC_DEBUG=2 to find those constants.
884
886
MAX_ALLOC = 17333
885
887
MIN_ALLOC = 1096
886
888
887
- payload = self .billion_laughs (10 , 4 )
889
+ payload = self .exponential_expansion_payload (10 , 4 )
888
890
889
891
p = expat .ParserCreate ()
890
892
p .SetAllocTrackerActivationThreshold (MAX_ALLOC + 1 )
0 commit comments