In computer security, a billion laughs attack is a type of denial-of-service (DoS) attack which is aimed at parsers of XML documents. It’s also referred to as an XML bomb or as an exponential entity expansion attack. The example attack consists of defining 10 entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to 1 billion copies of the first entity. In the most frequently cited example, the first entity is the string “lol”, hence the name “billion laughs”. The amount of memory used would likely exceed that available to the process parsing the XML (it certainly would have at the time the vulnerability was first reported).
While the original form of the attack was aimed specifically at XML parsers, the term may be applicable to similar subjects as well
The problem was first reported as early as 2003, but began to be widely addressed in 2008.
Defenses against this kind of attack include capping the memory allocated in an individual parser if loss of the document is acceptable, or treating entities symbolically and expanding them lazily only when (and to the extent) their content is to be used.
Code example
<?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
&lol9;
When an XML parser loads this document, it sees that it includes one root element, “lolz”, that contains the text “&lol9;”. However, “&lol9;” is a defined entity that expands to a string containing ten “&lol8;” strings. Each “&lol8;” string is a defined entity that expands to ten “&lol7;” strings, and so on.
After all the entity expansions have been processed, this small (< 1 KB) block of XML will actually contain a billion “lol”s, taking up almost 3 GB of memory.
We’re a group of volunteers and opening a new scheme in our community. Your website offered us with valuable information to work on. You’ve done an impressive job and our entire community will be grateful to you.
I’ve recently started a blog, and the information you provide on this website has helped me greatly. Thanks for all of your time & work.
I like this post, enjoyed this one thankyou for posting .
I’d want to visit your website more usually but currently it appears as though being getting ceaselessly to return up. I’m likely to from perform, and our own connection there is fairly excellent. Think the trouble could really maintain the finish?
a great and surely exciting submit, this is a fantastic share, hope to go through some more about this soon
Hi Generally there! our loved ones loves the gorgeous internet site thanks and also pls never stop!
Thank you for your entire initiatives you might have put in this kind of. very advantageous data.? The exile? s normal life is zero life.? by Leonidas regarding Tarentum.
Hey very cool blog!! Guy .. Excellent .. Wonderful .. I will bookmark your blog and take the feeds also…I am happy to search out numerous helpful information right here within the post, we want work out more techniques on this regard, thanks for sharing.
It is in reality a nice and helpful piece of info. I¡¦m satisfied that you simply shared this useful info with us. Please keep us up to date like this. Thanks for sharing.
Sources just like the one you mentioned here can be very useful to me! I will put up a link to this web page on my blog. I’m sure my guests will find that very useful.
Hello There. I found your blog using msn. This is a very well written article. I will be sure to bookmark it and return to read more of your useful info. Thanks for the post. I’ll certainly return.
How does one do? siblings simply love your own charming content thanx and pls continue
hey there and thank you for your information – I have definitely picked up something new from right here. I did however expertise several technical points using this web site, as I experienced to reload the site lots of times previous to I could get it to load correctly. I had been wondering if your hosting is OK? Not that I’m complaining, but sluggish loading instances times will often affect your placement in google and can damage your high-quality score if ads and marketing with Adwords. Anyway I am adding this RSS to my e-mail and can look out for much more of your respective intriguing content. Ensure that you update this again very soon..
Getting excited about reading much more. Great article post. Many thanks Again. Fantastic.
I am glad to be a visitant of this perfect site, thanks for this rare information!
of course like your web site but you need to check the spelling on quite a few of your posts. Several of them are rife with spelling problems and I find it very bothersome to tell the reality then again I will surely come back again.
Nice blog , I really wish how to make my website this interesting !
I think this is among the most important information for me personally. And i’m glad looking at your write-up. But wanna remark on a few general things, The internet site style is great, the articles is actually excellent: D. Good employment, cheers
Hello, you used to write fantastic, but the last several posts have been kinda boring… I miss your super writings. Past few posts are just a little out of track! come on!
As I site possessor I believe the content matter here is rattling fantastic , appreciate it for your hard work. You should keep it up forever! Best of luck.
As soon as i discovered this internet site I went on reddit to share with you some of the love with them. So far when i can keep in mind, there just isn’t one word within the Gospels in praise associated with intelligence. by Bertrand Russell.
Of course, what a fantastic site and informative posts, I surely will bookmark your site.All the Best!
Thanks for spending some time to talk about this, I sense strongly regarding it and value mastering much more on this specific subject. If achievable, as a person acquire information, would an individual mind updating your weblog with an increase of facts? It is very useful for me personally.
Hi presently there! I may have sworn I am to this blog before but after reading through a few of the post My partner and i realized it’s new to me. Anyhow, I’m definitely delighted I found it and I’ll be bookmarking and also checking again often!
Some actually superb information, Glad I found this. Anonymity may be the truest manifestation of altruism. by Eric Gibson.
The blog is actually original and i also enjoy that it is! The idea needs to end up being! You’re posting basic sophistication and type that we haven’t observed in age groups! The world wide web wants really you, youngster.
First of all I want to say wonderful blog! I had a quick question in which I’d like to ask if you don’t mind. I was interested to know how you center yourself and clear your mind prior to writing. I have had a tough time clearing my mind in getting my ideas out there. I truly do take pleasure in writing however it just seems like the first 10 to 15 minutes tend to be wasted just trying to figure out how to begin. Any ideas or hints? Many thanks!
Exhaustively flippant and also unsportsmanlike while using end associated with life
Excellent site. Lots of useful info here. I’m sending it to a few friends ans also sharing in delicious. And of course, thanks for your sweat!
Some truly nice and utilitarian info on this site, also I think the design and style has great features.
An extraordinary share, I just with all this onto the colleague who had been doing a little analysis on this. And he actually bought me personally breakfast because I discovered it regarding him.. smile. So allow me to reword which: Thnx for the treat! But yes Thnkx with regard to spending enough time to talk about this, I experience strongly regarding it and really like reading more for this topic. If probable, as you become expertise, would a person mind updating your website with more information? It is highly great for me. Big flash up for this blog publish!
I like as well as appreciate your blog article. Much thank you once again. A lot required.
I would like to thank you for the efforts you’ve put in writing this site. I am hoping the same high-grade website post from you in the upcoming also. In fact your creative writing skills has encouraged me to get my own web site now. Really the blogging is spreading its wings quickly. Your write up is a good example of it.
Couldn’t be written any better. Reading this submit jogs my memory of my old room mate! He all the time saved talking about this. I will ahead this text to him. Pretty sure he can have an excellent read. Thanks for sharing!
Hi, i think i noticed you been to my blog therefore i came to go back the favour. I am looking for issues to enhance my web page! I speculate its sufficient to utilize some of your respective ideas!!
Hello, such a reliable information in your blog listed here The public may be the firm base for charity Regards, Verna Vukich