NodetteHQ/PureXML
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases 1 Wiki Activity
1ae6680d94
PureXML/Sources/Parsing
History
Mihaela Mihaljevic 01a35cc6e6 feat(parser): optional DTD with internal entities and billion-laughs defense 
Add opt-in DTD processing behind Limits(allowDoctype:), off by default. When on,
DoctypeScanner reads the <!DOCTYPE> internal subset and honors internal
<!ENTITY name "value"> general entities, which EntityDecoder expands recursively
in text and attribute values.

Safety is mandatory and reimplemented from the Expat amplification-accounting
model (no upstream code copied):
- only entity-expanded characters count against a shared budget
  (Limits.maxEntityExpansion); overflow raises amplificationLimitExceeded, which
  defeats billion-laughs.
- a visiting set detects recursive entities (recursiveEntity).
- undeclared references raise undefinedEntity.
- external entities are never stored or loaded, so XXE stays closed.

The default still rejects <!DOCTYPE>. 8 DTD tests (incl. billion-laughs and the
external-entity refusal); 49 total.
2026-06-08 01:17:09 +02:00
..
ByteDecoder.swift feat(parser): accept raw bytes with UTF-8/UTF-16 encoding detection 2026-06-08 00:52:56 +02:00
DoctypeScanner.swift feat(parser): optional DTD with internal entities and billion-laughs defense 2026-06-08 01:17:09 +02:00
EntityDecoder.swift feat(parser): optional DTD with internal entities and billion-laughs defense 2026-06-08 01:17:09 +02:00
Event.swift feat(parser): add a streaming, iterative XML parser 2026-06-08 00:10:50 +02:00
EventReader.swift feat(parser): optional DTD with internal entities and billion-laughs defense 2026-06-08 01:17:09 +02:00
InputEncoding.swift feat(parser): accept raw bytes with UTF-8/UTF-16 encoding detection 2026-06-08 00:52:56 +02:00
Limits.swift feat(parser): optional DTD with internal entities and billion-laughs defense 2026-06-08 01:17:09 +02:00
Mark.swift chore: scaffold PureXML pure-Swift XML package 2026-06-07 23:20:20 +02:00
NamespaceContext.swift feat(parser): resolve XML namespaces at the start-element boundary 2026-06-08 01:03:29 +02:00
ParseError.swift feat(parser): optional DTD with internal entities and billion-laughs defense 2026-06-08 01:17:09 +02:00
Parser.swift feat(parser): streaming byte decode (incremental UTF-8/UTF-16) 2026-06-08 01:07:24 +02:00
Reader.swift feat(parser): add a streaming, iterative XML parser 2026-06-08 00:10:50 +02:00
StreamingDecoder.swift feat(parser): streaming byte decode (incremental UTF-8/UTF-16) 2026-06-08 01:07:24 +02:00