Skip to content

fix: harden XML parser in FileTypeDetector against XML bomb DoS - #2851

Merged
skylot merged 1 commit into
skylot:masterfrom
RuffaloLavoisier:fix/xml-bomb-dos-in-file-type-detector
Apr 14, 2026
Merged

fix: harden XML parser in FileTypeDetector against XML bomb DoS#2851
skylot merged 1 commit into
skylot:masterfrom
RuffaloLavoisier:fix/xml-bomb-dos-in-file-type-detector

Conversation

@RuffaloLavoisier

Copy link
Copy Markdown
Contributor

❗ Please review the guidelines for contributing

Description

A crafted APK containing a resource with nested entity expansion (Billion Laughs) could cause excessive memory consumption and crash jadx during file type detection.

@skylot skylot left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks.
Although, this code now looks the same as in

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setFeature("http://apache.org/xml/features/dom/create-entity-ref-nodes", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);

I will prepare a change to use parseXml from jadx security class instead this.

@skylot
skylot merged commit ccc4164 into skylot:master Apr 14, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants