Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Mon, 11 Dec 2006 16:36:36 -0500

Jeff Williams wrote:

Gosh, I guess it's impossible to attack anything with XML in it. I'm
going to upgrade my rainbow- and puppy-based security system to "happy
thoughts 2.0", now with XML.

It's certainly not possible to attack any real XML system by using CDATA unless you can carry out the same attack without using CDATA. Now if the system is only pretending to use XML it's a different story.

So what if the parser is better? The point is that it's easy to send
around attacks inside XML that's well-formed and validated.

No, it's not. It's certainly nowhere near as easy as sending an attack inside a Word file, for example. XML documents and parsers have a characteristic non-parser based solutions don't. Their behavior is deterministic. They have well-defined, reliable error behavior.

If a
security person is concerned about what's actually inside, good. They
need to make sure the data is safe enough to use. Is it going to a
database? Control business logic? Store in a file? Render in browser?
Some other interpreter?

I don't think you understand what's going on here. If a security person wants to look inside the file, they need to use an XML parser. Assuming they do that, the presence or absence of CDATA sections is irrelevant. If they don't use an XML parser, though, then they've created an insecure solution that may be vulnerable to buffer overflows and does offer a lot of ways to slip data by them.

--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page