cURL / Mailing Lists / curl-users / Single Mail

curl-users

Re: curl & malicious XML?

From: Bill Hines <bill.hines_at_us.ibm.com>
Date: Tue, 7 Feb 2006 16:52:00 -0500

Apologies, I just wasn't giving curl enough time to read the file. It is
quite large, so when I saw CPU maxed out for some time I assumed it was
parsing, but it was really just trying to load it. Once I gave it time to
do that, everything went fine.

                                                                           
             Daniel Stenberg
             <daniel_at_haxx.se>
             Sent by: To
             curl-users-bounce the curl tool
             s_at_cool.haxx.se <curl-users_at_cool.haxx.se>
                                                                        cc
                                                                           
             02/07/2006 04:16 Subject
             PM Re: curl & malicious XML?
                                                                           
                                                                           
             Please respond to
               the curl tool
             <curl-users_at_cool.
                 haxx.se>
                                                                           
                                                                           

On Tue, 7 Feb 2006, Bill Hines wrote:

> I'm trying to use curl to test a malicious xml scenario, sending an xml
> file with a huge number of xmlns: tags to my application server. But it
> appears that curl is trying to parse the xml file itself

curl does no such thing. It has no clue about XML or similar matters.

> racing the cpu at 95% cpu for the curl.exe process.

For how long? Is this a big file? What curl version? What operating system?

Using the -d @file construct will make curl read the whole file into memory

first, and then send it off to the server.

> Below is the command I'm using. Is there any way to have curl not process

> the xml so that I can try to submit it to my local server instance?

So it doesn't send the data when you use that command line?

--
  Commercial curl and libcurl Technical Support: http://haxx.se/curl.html
Received on 2006-02-07