Prevent xml bomb XercesDOMParser - C++

I am using XercesDOMParser to read an xml file in linux (c++), I 开发者_如何转开发want to prevent xml bomb (Billion laughs) so I set these properties:

parser->setDoNamespaces(true)
parser->setDisableDefaultEntityResolution(true)
parser->setEntityResolver(NULL)
parser->setSkipDTDValidation(true)

However, it doesn't help and bomb still remain. Do you know how to prevent it (I have to use xerces with DOM only)

10x!

---

There is no direct way to prevent entity expansion, and thus prevent the billion laughs attack. This is because billion laughs attacks can be well-formed XML, and XercesDOMParser is a pretty strict implementation of DOM. However, you can prevent the billion laughs attack in Xerces by adding a SecurityManager.

SecurityManager sm;
sm.setEntityExpansionLimit(100);

parser->setSecurityManager(&sm);

If you add that to your code, Xerces will throw a SAXParseException when the parser has expanded more than the number of Entities you set, in this case 100. This will prevent the billion laughs.

---

Or if you want to suppress the use of Entities altogether you can implement overrides on the DefaultHandler. In the declaration:

class MyHandler: public Xerces::DefaultHandler
{
   <...>
    void internalEntityDecl(
        const XMLCh* const name,
        const XMLCh* const value) override;


    void externalEntityDecl(
        const XMLCh* const name,
        const XMLCh* const publicId,
        const XMLCh* const systemId) override;
}

and in the definition:

void
XercesXMLHandler::internalEntityDecl(
    const XMLCh* const name,
    const XMLCh* const value )
{
    FailBecauseEntity( name );
}

void
XercesXMLHandler::externalEntityDecl(
    const XMLCh* const name,
    const XMLCh* const publicId,
    const XMLCh* const systemId )
{
    FailBecauseEntity( name );
}