Memory leak in SAX-PARSE method

Oct 9, 2020
Knowledge

Title

URL Name

Memory-leak-in-SAX-PARSE-method

Article Number

000195530

Environment

Product: OpenEdge Version: 11.x, 12x OS: All Supported Platforms

Question/Problem Description

The SAX-PARSE method has a severe memory leak in OpenEdge 11 and OpenEdge 12.

When repeatedly calling the method, the client session seems to consume memory and never release it. For example with the following code using a small, simple source xml file :

DEFINE VARIABLE i         AS INTEGER NO-UNDO.
DEFINE VARIABLE SaxReader AS HANDLE  NO-UNDO.

CREATE SAX-READER SaxReader.
SaxReader:SET-INPUT-SOURCE("FILE":U, "ssu.xml":U).
DO i = 1 TO 5000:
    SaxReader:SAX-PARSE().
END.
DELETE OBJECT SaxReader.

message "OUT" i view-as alert-box.

In the Windows Task Manager the client memory is observed to consistently grow and never release any of the memory it consumes.

The same problem does not happen in 10.2B.

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

OCTA-30653

Enhancement Number

Cause

The problem was introduced when a new security feature (ENTITY-EXPANSION-LIMIT) was implemented. This feature is now ON by default and unfortunately every time the client uses the PARSE methods a new security manager is created and never deleted. This is the cause of the memory leak.

The problem will happen specifically with the SAX-PARSE and SAX-PARSE-FIRST methods.
The problem does not happen with the SAX-PARSE-NEXT method.

Resolution

Fixed version(s): OpenEdge 12.4, OpenEdge 12.2.4, OpenEdge 11.7.9

Workaround

To work around the problem disable this new feature (set ENTITY-EXPANSION-LIMIT = ?) after creating the SAX-READER object, for example:

CREATE SAX-READER SaxReader.
SaxReader:ENTITY-EXPANSION-LIMIT = ?.
SaxReader:SET-INPUT-SOURCE("FILE":U, "ssu.xml":U).
DO i = 1 TO 5000:
  SaxReader:SAX-PARSE().
END.
DELETE OBJECT SaxReader.

Obviously disabling this security feature will make the application more susceptible to the XML Bomb attack (doing recursive entity substitutions). See https://en.wikipedia.org/wiki/Billion_laughs_attack

Additionally there is a client startup parameter (-entityExpansionLimit) that is intended to limit the number of entity substitutions the XML parsers will allow. Unfortunately this startup parameter cannot be used to work around this problem. The only way to work around this would be to modify the code as described above.

Notes

References to Other Documentation:
OpenEdge Development: ABL Reference, Chapter 4: Handle Attributes and Methods Reference, ENTITY-EXPANSION-LIMIT attribute
https://en.wikipedia.org/wiki/Billion_laughs_attack)

Progress Article(s):
000175951, X-DOCUMENT handle susceptible to XML entity expansion attack

Keyword Phrase

Last Modified Date

10/23/2023 12:09 PM

Memory leak in SAX-PARSE method

Files(0)

Was this article helpful?

Was this article helpful?

Memory leak in SAX-PARSE method

Information

Related Articles