Currently there are limits to many aspects of input (nesting, max attribute, element lengths), but not one for limiting nesting within DTD subset. Let's add setting for maximum DTD nesting of 500, matching existing WstxInputProperties.P_MAX_ENTITY_DEPTH used for regular entities (could alternatively match WstxInputProperties.P_MAX_ELEMENT_DEPTH of 1000).
This needs to be configurable as well with, say
WstxInputProperties.P_MAX_DTD_DEPTH
NOTE: this issue is for resolving [CVE-2022-40152]
(note: originally reported as #157)
Currently there are limits to many aspects of input (nesting, max attribute, element lengths), but not one for limiting nesting within DTD subset. Let's add setting for maximum DTD nesting of 500, matching existing
WstxInputProperties.P_MAX_ENTITY_DEPTH
used for regular entities (could alternatively matchWstxInputProperties.P_MAX_ELEMENT_DEPTH
of 1000).This needs to be configurable as well with, say
NOTE: this issue is for resolving [CVE-2022-40152]