Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Fixed
-
Java 2.0.0
-
None
Description
I tried to build the Java 2.0.0 branch and found that two of the BaltimoreEnvTest test cases fail with this error:
Maximum (50) allowed XML Structure size exceeded.
the test-cases are:
test_five_content_aes128_cbc_rsa_15
test_five_data_3des_cbc_rsa_oaep
I checked the AbstractDecryptInputProcessor which is causing this error and found that this limit is hardcoded.
now the question is:
why does this limit exist and why is this so small ?
the xml-enc structure in test_five_content_aes128_cbc_rsa_15 has 54 XML-events and the other has 58.
I also noticed that the "maximumAllowedXMLStructureDepth" is configurable and has a default of 100.
However, with a limit of 50 xml-events this theoretical structure-depth can never be reached even remotely.