diff options
| author | Shai Berger <shai@platonix.com> | 2025-10-11 21:42:56 +0300 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-12-02 09:44:40 -0300 |
| commit | 4d2b8803bebcdefd2b76e9e8fc528d5fddea93f0 (patch) | |
| tree | a8931c086dd3830c827f2a090c4c7c7e655f21cf /package.json | |
| parent | f997037b235f6b5c9e7c4a501491ec45f3400f3d (diff) | |
[4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.
Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.
The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.
Thanks Seokchan Yoon (https://ch4n3.kr/) for report.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
Diffstat (limited to 'package.json')
0 files changed, 0 insertions, 0 deletions