CodeQL library for Python
codeql/python-all 0.11.15-dev (changelog, source)
Search

Member predicate XML::XmlParsingVulnerabilityKind::isXmlBomb

Holds for XML bomb vulnerability kind, such as ‘Billion Laughs’ and ‘Quadratic Blowup’.

While a parser could technically be vulnerable to one and not the other, from our point of view the interesting part is that it IS vulnerable to these types of attacks, and not so much which one specifically works. In practice I haven’t seen a parser that is vulnerable to one and not the other.

predicate isXmlBomb()