patrickfrey / textwolf Goto Github PK

Entity definitions as defined in XML are known as a source of possible DoS attacks.
textwolf allows only character entities and they have to be passed down from the caller.
I do not see any reason to change this.

textwolf calculates an estimation of how much memory it will use when processing XML input.
This mechanism leads to out of memory exceptions when the expressions get complex.
Rethink and reimplement !

UTF-8 characters beyond 2147483649 are a pure academic issue anyway.

Entity definitions in the XML processed are ignored.
Entity definitions have to be passed to the parser as read only table.
If they are defined in this table they are parsed and substituted in the XML source.

The character set encoding has to be detected by the caller.
So BOM character sequences (Byte Order Mark U+FEFF in UTF-16)
should be ignored. Currently this is not the case.
The caller has to pass an XML without leading BOM characters down to textwolf.
Because the client has to detect the character set encoding anyway, skipping BOM
before passing th content to textwolf should be doable without big effort.