Skip to content

Fix infinite entity expansion by detecting circular references#312

Open
naitoh wants to merge 1 commit intoruby:masterfrom
naitoh:fix_detecting_circular_references
Open

Fix infinite entity expansion by detecting circular references#312
naitoh wants to merge 1 commit intoruby:masterfrom
naitoh:fix_detecting_circular_references

Conversation

@naitoh
Copy link
Copy Markdown
Contributor

@naitoh naitoh commented May 5, 2026

Why?

Fix an issue where a stack level too deep (SystemStackError) error caused by a circular reference was not detected as an appropriate error.

require 'rexml/parsers/streamparser'
require 'rexml/streamlistener'

source = <<~XML
<!DOCTYPE root [
  <!ENTITY x "&x;">
]>
<root>&x;</root>
XML

listener = Class.new { include REXML::StreamListener }.new
REXML::Parsers::StreamParser.new(source, listener).parse
  • before
lib/rexml/parsers/baseparser.rb:544:in 'REXML::Parsers::BaseParser#entity': stack level too deep (SystemStackError)
  • after
lib/rexml/parsers/baseparser.rb:543:in 'REXML::Parsers::BaseParser#entity': Detected an entity reference loop: x (RuntimeError)

## Why?
Fix an issue where a `stack level too deep (SystemStackError)` error caused by a circular reference was not detected as an appropriate error.

```
require 'rexml/parsers/streamparser'
require 'rexml/streamlistener'

source = <<~XML
<!DOCTYPE root [
  <!ENTITY x "&x;">
]>
<root>&x;</root>
XML

listener = Class.new { include REXML::StreamListener }.new
REXML::Parsers::StreamParser.new(source, listener).parse
```

- before
```
lib/rexml/parsers/baseparser.rb:544:in 'REXML::Parsers::BaseParser#entity': stack level too deep (SystemStackError)
```
- after
```
lib/rexml/parsers/baseparser.rb:543:in 'REXML::Parsers::BaseParser#entity': Detected an entity reference loop: x (RuntimeError)
```
@naitoh naitoh requested a review from kou May 5, 2026 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant