Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
  • Date: Tue, 12 Dec 2006 07:00:40 -0500

Jeff Williams wrote:

Even if the parser is perfect, you can trick applications into including
attacks in XML documents. Anyone including user data in their XML
anywhere?

Even if the parser is perfect, these attacks can subvert the
applications that use the XML. For example, you can send a SQL injection
attack inside an XML element to a web service that is backed by a
database. I've found this flaw in several commercial products.

Even if the parser is perfect, XSS attacks inside XML or XML fragments
can compromise the browser's security. Virtually every "Web 2.0"
application has this flaw, whether they use REST or SOAP, JSON or XML --
because a lot of it ends up in the browser eventually.

And this has what to do with the issue of CDATA sections?

If a security person wants to look inside the file, they need to use
an XML parser.

Agreed. And they get some assurance that the parsing worked. But they
get no assurance that the data inside the document is safe to use.


And this has what to do with the issue of CDATA sections?

--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page