Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Mon, 11 Dec 2006 14:30:33 -0500

Jeff Williams wrote:

Which was the right answer. You're advocating a "blacklist" kind of
security which doesn't work. A "positive" or "whitelist" security model
(where you deny everything and create exceptions for the things you know
should be allowed) is generally simpler and much more secure.

Either you let in XML or you don't. If you do let it in the robust nature of well-formedness and optional validity checking, means XML solutions are more secure. I'm much more confident with an XML system than I am with anything hand-rolled, including fake XML parsers. Subsetting XML to prohibit particular kinds of syntax sugar is just asking for security holes. What that tells me is that someone is using a non-XML tool to process the XML data, and that is dangerous.

See
http://www.owasp.org/index.php/Category:Principle for discussion of this
and other application security principles.

Readers of the list might be interested in XML attacks like
http://www.owasp.org/index.php/Blind_XPath_Injection
http://www.owasp.org/index.php/XML_Injection

FUD. That has nothing to do with the issue at hand.

--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page