"Billion Laughs" is a classic DoS attack against XML by nesting entities. Think of something like you define &a; is a string, then &b; is 10 times &a;, &c; is 10 times &b; etc. If an XML parser naively resolves these, it may use excessive amounts of memory, crash, or take forever.
This is an inherent flaw in the XML spec, which is one of many reasons why XML is bad. Parsers have various unsatisfying workarounds by limiting things. I noted that, regularly, new variations of this flaw show up 🧵
0 Boosts
0 Likes
It turned out that my simple script quickly found variations that took Expat several seconds to parse. Sebastian recognized this as a bug, but, apparently, it wasn't easy to fix, so it took quite a while. Given that I sympathize with all the guys from nebraska out there, I wasn't really in a mood to have hard disclosure timelines for this weighting the circumstances (minor issue, difficult fix). But it's fixed now, so I can share it.
You can find the script here: https://github.com/hannob/lololol
Fixed in Expat 2.10.0, blogpost by Sebastian here: https://blog.hartwork.org/posts/expat-2-10-0-released/
The variations often just differ by minor things, like repetition per entity or depth of repetition etc. - so I had a simple idea: randomly generate variations of payloads. A sort of "billion laughs" fuzzer.
That ended up creating quite a bit of work for someone you may know under his nickname "Guy from Nebraska". There's a famous comic about him. He isn't really from Nebraska, he's from Berlin. His name is Sebastian Pipping and he's the maintainer of Expat, one of the major XML libraries.