diff --git a/expat/doc/xmlwf.xml b/expat/doc/xmlwf.xml index 1105bff4..c79041bc 100644 --- a/expat/doc/xmlwf.xml +++ b/expat/doc/xmlwf.xml @@ -4,7 +4,7 @@ Scott"> Bronson"> - April 25, 2021"> + May 4, 2021"> 1"> @@ -131,6 +131,50 @@ supports both. + + factor + + + Sets the maximum tolerated amplification factor + for protection against billion laughs attacks (default: 100.0). + The amplification factor is calculated as .. + + + amplification := (direct + indirect) / direct + + + .. while parsing, whereas + <direct> is the number of bytes read + from the primary document in parsing and + <indirect> is the number of bytes + added by expanding entities and reading of external DTD files, + combined. + + + NOTE: + If you ever need to increase this value for non-attack payload, + please file a bug report. + + + + + + bytes + + + Sets the number of output bytes (including amplification) + needed to activate protection against billion laughs attacks + (default: 8 MiB). + This can be thought of as an "activation threshold". + + + NOTE: + If you ever need to increase this value for non-attack payload, + please file a bug report. + + + + @@ -458,6 +502,7 @@ supports both. The Expat home page: https://libexpat.github.io/ The W3 XML 1.0 specification (fourth edition): https://www.w3.org/TR/2006/REC-xml-20060816/ +Billion laughs attack: https://en.wikipedia.org/wiki/Billion_laughs_attack