From bf878495985b81731c620bbac26df79e6c98c9fd Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sun, 25 Apr 2021 18:16:14 +0200 Subject: [PATCH] xmlwf.1: Document arguments -a and -b --- doc/xmlwf.xml | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/doc/xmlwf.xml b/doc/xmlwf.xml index 5e2a4ae..648b581 100644 --- a/doc/xmlwf.xml +++ b/doc/xmlwf.xml @@ -3,7 +3,7 @@ Scott"> Bronson"> - March 11, 2016"> + May 4, 2021"> 1"> @@ -140,6 +140,50 @@ supports both. + factor + + + Sets the maximum tolerated amplification factor + for protection against billion laughs attacks (default: 100.0). + The amplification factor is calculated as .. + + + amplification := (direct + indirect) / direct + + + .. while parsing, whereas + <direct> is the number of bytes read + from the primary document in parsing and + <indirect> is the number of bytes + added by expanding entities and reading of external DTD files, + combined. + + + NOTE: + If you ever need to increase this value for non-attack payload, + please file a bug report. + + + + + + bytes + + + Sets the number of output bytes (including amplification) + needed to activate protection against billion laughs attacks + (default: 8 MiB). + This can be thought of as an "activation threshold". + + + NOTE: + If you ever need to increase this value for non-attack payload, + please file a bug report. + + + + + @@ -434,6 +478,7 @@ http://www.xml.com/pub/a/tools/ruwf/check.html The Expat home page: http://www.libexpat.org/ The W3 XML specification: http://www.w3.org/TR/REC-xml +Billion laughs attack: https://en.wikipedia.org/wiki/Billion_laughs_attack -- 1.8.3.1