Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
  • Date: Tue, 12 Dec 2006 07:02:52 -0500

Jeff Williams wrote:

Have you looked? XPath code that takes user input is just as likely to
be vulnerable to injection as SQL code that takes user input. I found it
in a customer's application just last week.

I just don't see a lot (or any) XPath code that takes user input. I'd love to hear details about any real world cases you've encountered though. I do see lots of SQL code that takes user input.

Perhaps this will change if native XML databases become as prevalent as I expect over the next couple of years.

--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page