Billion laughs attack

If you're parsing XML then external entities (allowing local file inclusion or server side request forgery) are much more dangerous for you than this denial of service. OWASP has a cheat sheet for disabling XXE on a few different parsers:

https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Pr...

Interestingly, many browsers are still susceptible to this attack, for example when used in SVG files (WARNING: might crash your browser and/or operating system): https://jsfiddle.net/e3guLn08/

Is this just a 21st century zipbomb?

0: https://en.m.wikipedia.org/wiki/Zip_bomb

And here I thought this would be a variant of the hypothetical Chinese chair attack: https://www.straightdope.com/columns/read/142/if-all-chinese...

A similar attack on CSS in browsers was shown recently here: https://cras.sh/

> A "Billion laughs" attack should exist for any file format that can contain references, for example this YAML bomb:

C preprocessor?

  $ gcc -E - | wc
  #define EXP(X) X X X X X X X X X X X X X X X X
  #define LOL1 EXP(LOL)
  #define LOL2 EXP(LOL1)
  #define LOL3 EXP(LOL2)
  #define LOL4 EXP(LOL3)
  #define LOL5 EXP(LOL4)
  LOL5
  [Ctrl-D][Enter]
  11 1048588 4194376

Not normally considered a "file format", though. People don't open a C preprocessor attachment in their e-mail only to have some application grind their PC and crash. Or use this for RPC calls and whatnot.

This is loads of fun against batteries included web frameworks like rail, grails, play framework and so on. Not sure about now, but a few years ago basically all of them were susceptible to this and XXE and it was extremely difficult to disable in the XML parsers.

This was been around for well over a decade. Interestingly though, denial of service is the less interesting issue that external entity parsing comes with. It can lead all the way to data exfiltration and remote code execution.

Time to switch to JSON

This is why I switched from yaml to scl. (Rust)

https://github.com/Keats/scl

EDIT: In spite of those who are downvoting my comment without even replying, I'm leaving it anyway; cause sharing good software outweighs whatever loss they intend to inflict.