Lars Knoll fd4be84d23 Add an expansion limit for entities ... Recursively defined entities can easily exhaust all available memory. Limit entity expansion to a default of 4096 characters to avoid DoS attacks when a user loads untrusted content. Added a setter and getter to allow modifying the expansion limit. [ChangeLog][QtCore][QXmlStream] QXmlStreamReader does now by default limit the expansion of entities to 4096 characters. Documents where a single entity expands to more characters than the limit are not considered well formed. The limit is there to avoid DoS attacks through recursively expanding entities when loading untrusted content. The limit can be changed through the QXmlStreamReader::setEntityExpansionLimit() method. Fixes: QTBUG-47417 Change-Id: I94387815d74fcf34783e136387ee57fac5ded0c9 Reviewed-by: Oswald Buddenhagen <oswald.buddenhagen@gmx.de> Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>		2020-02-26 22:08:38 +01:00
..
data	QXmlStreamReader: early return in case of malformed attributes	2020-01-23 19:44:09 +01:00
XML-Test-Suite	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
.gitattributes	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
.gitignore	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
qc14n.h	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
qxmlstream.pro	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
setupSuite.sh	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00
tst_qxmlstream.cpp	Add an expansion limit for entities	2020-02-26 22:08:38 +01:00
XML-Test-Suite-LICENSE.txt	Create corelib/serialization and move existing file formats into it	2018-01-26 20:59:50 +00:00