Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XPath injection

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Wolfgang Hoschek <wolfgang.hoschek AT mac.com>
  • Cc: Jeff Williams <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XPath injection
  • Date: Mon, 11 Dec 2006 16:40:23 -0500

Wolfgang Hoschek wrote:

XPath injection (i.e. a query that is formed by plain string concatenation of query template and user provided string) is a different problem, but potentially serious nonetheless, just as SQL injection is.

It's real, though I've never seen it come up in practice, unlike SQL injection which happens all the time. However, it is in now way affected by the question of whether or not we allow CDATA sections in documents.

--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page