204 2003-04-19 23:46:10 +0000 Potential DoS in Recursive Calls 2005-02-05 21:03:10 +0000 1 1 1 Unclassified Validator check 0.6.1 All All RESOLVED FIXED http://www.w3.org/mid/20030226204438.GB3795@fractalus.com P2 critical --- 856 1 link link www-validator-cvs oldest_to_newest 454 0 link 2003-04-19 23:46:10 +0000 From: SteveC <steve@fractalus.com> I looked for a while through the mailing list archive and couldn't find anything like this so please don't flame me :-) It appears possible to ask the validator to check itself, then check itself checking itself, then check itself checking itself checking itself and so on recursively. I tried the first 6 levels of recursion and got a roughly linearly increasing delay of about and extra second per recursion level. This makes it interesting as a DoS attack as you could cause multiple amounts of load on the machine for trivial increase in network traffic. I don't know if it is actually calling itself, but the increasing load time would seem to suggest it. 504 1 link 2003-05-24 07:52:01 +0000 Ain't gonna happen for 0.6.2; retargetting to 0.7.0. 2198 2 link 2004-09-01 13:01:42 +0000 This should at the very least be investigated for possible fix for 0.7.0. 2307 3 link 2004-09-09 18:28:00 +0000 All the ideas I can come up with for resolving this are crufty or incomplete, so I'm leaving off touching this for 0.7.0 (feel free to jump in here if you have a good idea). Retargetting and removing blocker. 2553 4 bjoern 2004-10-23 13:26:02 +0000 http://lists.w3.org/Archives/Public/site-comments/2004Oct/0000.html 4228 5 link 2005-02-05 21:03:10 +0000 We now have a first approximation of a fix for this in CVS HEAD.