Fork bombing

[conartist6]

It is possible with this proposal if you control any part of the content of the web page to output content which will DOS the system by expanding a small chunk of HTML to a very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very very large chunk of DOM.

Yes I generated a lot of very's by copy pasting a few of them, because that's what a fork bomb does.

[noamr]

I don't think so? Examples maybe of how this would be generated and why it's a problem or novel in any way?

[conartist6]

I think it wasn't novel with XSLT in the picture, bit without XSLT it may be. The attack is possible any time you can have an input which can be compresed by reusing subparts of its own tree and you're forced to recursively expand everything without being able to reuse subparts. That sounds like the situation here.

To exploit it I'd make a template. Then I'd make second template which makes 10 instances of the first template and adds them to the dom. Then I'd make a third template which adds 10 instances of the second template and adds them to the dom. Then I'd make a fourth template...

[noamr]

I think it wasn't novel with XSLT in the picture, bit without XSLT it may be. The attack is possible any time you can have an input which can be compresed by reusing subparts of its own tree and you're forced to recursively expand everything without being able to reuse subparts. That sounds like the situation here.

To exploit it I'd make a template. Then I'd make second template which makes 10 instances of the first template and adds them to the dom. Then I'd make a third template which adds 10 instances of the second template and adds them to the dom. Then I'd make a fourth template...

Ok but the current proposal doesn't let you duplicate markup in that way