Method and apparatus for processing a parseable document

• US 8,176,413 B2
• Filed: 03/31/2008
• Issued: 05/08/2012
• Est. Priority Date: 05/27/2005
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Marcy, Glenn A., Van Lunteren, Jan, Waldvogel, Marcel
• Primary Examiner(s): NGUYEN, CHAU T
• Application Number:
  US12/059,913
• Publication Number:
  US 20080184105A1
• Time in Patent Office: 1,499 Days
• Field of Search: 715/234, 715/237, 715/239, 715/248, 715/249, 715/255, 715/256, 726/23, 726/24
• US Class Current: 715/237
• CPC Class Codes: G06F 40/143 Markup, e.g. Standard Generalized Markup Language [SGML] or Document Type Definition [DTD]
• CPC Class Codes: G06F 40/226 Validation

Abstract

A data processing method comprises receiving an electronically parseable document, scanning the document according to at least one predefined rule to determine if the document is suspicious, and, if the document is determined not to be suspicious, parsing the document with a first parser, and, if the document is determined to be suspicious, parsing the document with a second parser.

Claims

1. A data processing method, comprising:

receiving an electronically parseable document; and

scanning the document according to at least one predefined rule to determine if the document is suspicious,

wherein if the document is determined not to be suspicious, passing the document from a scanner to a first parser, and parsing the document with the first parser, and

wherein if the document is determined to be suspicious, passing the document from the scanner to a second parser without passing the document from the scanner to the first parser, and parsing the document with the second parser,

wherein the document is determined to be suspicious if the document includes a property that may cause a receiving computer system to fail,

wherein the document is determined to be suspicious if the document comprises a well-formed document within a plurality of rules, but when the document is parsed, the document fails or slows down the receiving computer system to fail, and

wherein the property includes at least one of a length of an attribute name, a number of an attribute per element, and a number of nested elements that exceeds a predetermined threshold.

2. The method according to claim 1, wherein the first parser is faster than the second parser.

3. The method according to claim 1, further comprising, while scanning the document, converting the document from a first format to a second format.

4. The method according to claim 1, further comprising monitoring a performance of the first parser, and adjusting at least one of said at least one predefined rule in dependence on the monitoring.

5. The method according to claim 1, further comprising monitoring a performance of the first parser, and creating a new rule in dependence on the monitoring.

6. The method according to claim 1, further comprising monitoring a performance of the second parser, and in a predefined circumstance, discarding another document prior to parsing, if said document is of a particular form.

7. A data processing apparatus, comprising:

a scanner for receiving an electronically parseable document, and for scanning the document according to at least one predefined rule to determine if the document is suspicious;

a first parser for parsing the document if the document is determined not to be suspicious; and

a second parser for parsing the document if the document is determined to be suspicious,

wherein the scanner is adapted to determine if the document is suspicious before passing the document to one of the first parser or the second parser,

wherein if the document is determined to be suspicious, the document is passed from the scanner to the second parser without first passing the document from the scanner to the first parser,

wherein the document is determined to be suspicious if the document includes a property that may cause a receiving computer system to fail,

wherein the document is determined to be suspicious if the document comprises a well-formed document within a plurality of rules, but when the document is parsed, the document fails or slows down the receiving computer system to fail, and

wherein the property includes at least one of a length of an attribute name, a number of an attribute per element, and a number of nested elements that exceeds a predetermined threshold.

8. The apparatus according to claim 7, wherein the first parser is faster than the second parser, and

wherein the second parser is adapted to send the document that has been determined to be suspicious to a storage, if a parsing of the document is determined to exceed a predetermined constraint comprising one of a processing time, and a predetermined memory usage value.

9. The apparatus according to claim 7, wherein the scanner is arranged, while scanning the document, to convert the document from a first format to a second format.

10. The apparatus according to claim 7, the apparatus being designed to monitor the performance of the first parser and to adjust at least one of said at least one predefined rule in dependence on the monitoring.

11. The apparatus according to claim 7, being designed to monitor a performance of the first parser and to create a new rule in dependence on the monitoring.

12. The apparatus according to claim 7, the apparatus being designed to monitor a performance of the second parser and in a predefined circumstance, to discard said document prior to parsing, if said document is of a particular form.

13. A tangible computer-readable storage non-transitory medium encoded with a computer program which, when loaded in a processor, configures said processor to perform a method, said method comprising:

receiving an electronically parseable document; and

scanning the document according to at least one predefined rule to determine if the document is suspicious,

wherein if the document is determined not to be suspicious, passing the document from a scanner to a first parser, and parsing the document with the first parser,

wherein if the document is determined to be suspicious, passing the document from the scanner to a second parser, and parsing the document with the second parser without passing the document from the scanner to the first parser,

wherein the document is determined to be suspicious if the document includes a property that may cause a receiving computer system to fail,

wherein the document is determined to be suspicious if the document comprises a well-formed document within a plurality of rules, but when the document is parsed, the document fails or slows down the receiving computer system to fail, and

wherein the property includes at least one of a length of an attribute name, a number of an attribute per element, and a number of nested elements that exceeds a predetermined threshold.

14. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, further comprising preventing a computer from failing as a result of processing a suspicious document, when the computer program is loaded in the processor.

15. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, wherein the first parser is faster than the second parser.

16. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, wherein said method further comprises, while scanning the document, converting the document from a first format to a second format.

17. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, wherein said method further comprises monitoring a performance of the first parser, and adjusting at least one of said at least one predefined rule in dependence on the monitoring.

18. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, wherein said method further comprises monitoring a performance of the first parser, and creating a new rule in dependence on the monitoring.

19. The computer-readable storage non-transitory medium encoded with the computer program according to claim 13, wherein said method further comprises monitoring a performance of the second parser, and in a predefined circumstance, discarding another document prior to parsing, if said document is of a particular form.