[XERCESJ-1616] Extremly Slow XML declaration parsing

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.11.0
• Component/s: JAXP (javax.xml.parsers)
• Assignee: Unassigned
• Reporter: Tomas Kacer
• Created: 26/Jun/13 11:57
• Updated: 12/Aug/13 13:11

Description

For specially crafted XML files (e.g. created by codenomicon test tool) with injected data in the XML declaration the parser spends too much time parsing the XML decl until it fails, due to its per byte/character processing here. MayReadChunks is not used here for some reason and it is horrible slow because of that and just hogs the single CPU core until it finally fails.

Either xerces should be very strict what can be in the XML decl (as that is defined by DTD and should fail with the first character that doesn't match the DTD and not use generic parsing for those attributes until the whole attribute is parsed) or provide reasonable performance processing XML decl (e.g. enable mayReadChunks while processing the XML decl, not sure what sideeffects it could have, worked fine for my request when enabled before).