diff options
Diffstat (limited to 'lib/rexml')
-rw-r--r-- | lib/rexml/document.rb | 12 | ||||
-rw-r--r-- | lib/rexml/text.rb | 40 |
2 files changed, 37 insertions, 15 deletions
diff --git a/lib/rexml/document.rb b/lib/rexml/document.rb index 96db53bdb0..f15c1bd762 100644 --- a/lib/rexml/document.rb +++ b/lib/rexml/document.rb @@ -217,6 +217,18 @@ module REXML return @@entity_expansion_limit end + @@entity_expansion_text_limit = 10_240 + + # Set the entity expansion limit. By default the limit is set to 10240. + def Document::entity_expansion_text_limit=( val ) + @@entity_expansion_text_limit = val + end + + # Get the entity expansion limit. By default the limit is set to 10000. + def Document::entity_expansion_text_limit + return @@entity_expansion_text_limit + end + attr_reader :entity_expansion_count def record_entity_expansion diff --git a/lib/rexml/text.rb b/lib/rexml/text.rb index 6623c0c03b..878d13b8e8 100644 --- a/lib/rexml/text.rb +++ b/lib/rexml/text.rb @@ -380,25 +380,35 @@ module REXML # Unescapes all possible entities def Text::unnormalize( string, doctype=nil, filter=nil, illegal=nil ) + sum = 0 string.gsub( /\r\n?/, "\n" ).gsub( REFERENCE ) { - ref = $& - if ref[1] == ?# - if ref[2] == ?x - [ref[3...-1].to_i(16)].pack('U*') - else - [ref[2...-1].to_i].pack('U*') - end - elsif ref == '&' - '&' - elsif filter and filter.include?( ref[1...-1] ) - ref - elsif doctype - doctype.entity( ref[1...-1] ) or ref + s = Text.expand($&, doctype, filter) + if sum + s.bytesize > Document.entity_expansion_text_limit + raise "entity expansion has grown too large" else - entity_value = DocType::DEFAULT_ENTITIES[ ref[1...-1] ] - entity_value ? entity_value.value : ref + sum += s.bytesize end + s } end + + def Text.expand(ref, doctype, filter) + if ref[1] == ?# + if ref[2] == ?x + [ref[3...-1].to_i(16)].pack('U*') + else + [ref[2...-1].to_i].pack('U*') + end + elsif ref == '&' + '&' + elsif filter and filter.include?( ref[1...-1] ) + ref + elsif doctype + doctype.entity( ref[1...-1] ) or ref + else + entity_value = DocType::DEFAULT_ENTITIES[ ref[1...-1] ] + entity_value ? entity_value.value : ref + end + end end end |