oxml
🌐 EN
English Français
llms.txt

Assurance & Hardening

Security Architecture & Threat Model

Engineered from the ground up for memory safety: #![forbid(unsafe_code)], proactive defenses against XXE and Billion Laughs attacks, and automated continuous fuzzing.

Memory Safety & Zero-Unsafe Guarantee

Historically, XML parsers implemented in C and C++ (including libxml2, Expat, and Xerces) have been subject to severe memory safety vulnerabilities: buffer overruns, use-after-free conditions, integer truncation, and out-of-bounds pointer arithmetic.

oxml guarantees compile-time memory safety across its entire codebase:

  • #![forbid(unsafe_code)]: Statically enforced at the root of every crate in the workspace. Any attempt to introduce an unsafe block fails compilation during cargo check and CI gating.
  • Generational Arena Management: DOM node lifetimes are bounded by the document container. Node relationships use safe generational indices instead of raw pointers, eliminating dangling references and use-after-free bugs.
  • Zero External Dependencies: The core parser and DOM modules depend strictly on the Rust standard library (and core/alloc under no_std), eliminating transitive supply-chain risks.

XML Attack Mitigations & Threat Model

Untrusted XML documents can be crafted maliciously to exhaust CPU, consume unbounded RAM, or exfiltrate private system files. oxml implements strict, deterministic defenses against standard XML attack vectors:

Vulnerability Class Attack Vector oxml Mitigation Strategy
XXE Injection (CWE-611) External DTDs and SYSTEM entities attempting to read local files (e.g. /etc/passwd) or trigger SSRF network requests. Disabled by default. External DTD retrieval is disabled. No network sockets or filesystem reads are ever initiated during parsing.
Billion Laughs (CWE-776) Exponential entity expansion where recursive internal general entities expand into gigabytes of memory. Bounded expansion depth. Recursion depth is capped at 32 levels, and total expanded entity byte count is capped at 10 MB. Exceeding limits aborts parsing immediately.
Quadratic Blowup Thousands of large entities defined within a single DTD to consume CPU time quadratically. Linear scan threshold. Cumulative entity expansion length is tracked globally against input length.
Stack Overflow / Deep Nesting XML documents with thousands of deeply nested open tags designed to smash the call stack. Maximum depth limit. Maximum element nesting depth is enforced (default 512). Parsing fails deterministically with SyntaxError::DepthLimitExceeded.

Continuous Fuzzing & Vulnerability Disclosure

Continuous Fuzzing Harnesses

All parsers and XPath evaluators are subjected to continuous fuzzing using cargo-fuzz (backed by LLVM LibFuzzer) and honggfuzz-rs:

  • Fuzz targets cover streaming token parsing, XPath query compilation, and XSD facet validation.
  • Corpus includes W3C XML conformance suites, AFL/LibFuzzer regression dictionaries, and mutated malformed XML inputs.
  • Automated GitHub Actions CI runs cargo-deny and cargo-audit to verify that dependencies have no known security advisories.

Responsible Vulnerability Disclosure

If you identify a security defect, unexpected panic, or resource exhaustion vulnerability in any oxml crate:

  1. Email: Send a confidential report to security@oxmllib.com.
  2. GitHub Security Advisories: Alternatively, open a private vulnerability report via GitHub Security Advisory.
  3. SLA: We acknowledge reports within 24 hours, provide an initial assessment within 48 hours, and coordinate CVE assignment and patch release within 7 days.