XML bomb detection

An XML bomb is a few kilobytes that expand to gigabytes while a program reads them. It declares an entity, then ten entities made of ten copies of the first, and so on, so nine lines name a billion copies of one word.

Why does it matter?

The slicer runs out of memory and hangs or crashes. This is CWE-776.

Which slicers did it hang?

Slic3r, SuperSlicer and ideaMaker, in the 2023 study Security Analysis of the 3MF Data Format (Rossel, Mladenov and Somorovsky, RAID 2023). The authors tested 20 apps that read 3MF and found 16 vulnerable to at least one attack.

Are current slicers exposed?

expat 2.4.0 and later stop a document once its entities grow it more than 100 times past the first 8 MiB (Changes). pugixml does not expand entities declared in the file. lib3mf, the 3MF Consortium's reader, accepts only the five built-in XML entities and rejects any other (NMR_XmlReader_Native.cpp). A Linux build may link the system expat instead; an up-to-date system has 2.4.0 or later.

What does preslice check?

Every XML file, for more than ten entity definitions or entities that refer to each other.

What does a fail mean?

The file defines suspicious entities. No normal slicer writes them.

What do I do when the check fails?

Do not open the file in an old slicer or in Slic3r, SuperSlicer or ideaMaker. Open the named file in the Raw tab: a <!DOCTYPE block full of <!ENTITY lines at the top is the bomb. Delete the file and tell whoever shared it.