Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: John Cowan <cowan AT ccil.org>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: Elliotte Harold <elharo AT metalab.unc.edu>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Mon, 11 Dec 2006 15:19:32 -0500

Jeff Williams scripsit:

> The point is that it's easy to send around attacks inside XML that's
> well-formed and validated. If a security person is concerned about
> what's actually inside, good. They need to make sure the data is safe
> enough to use. Is it going to a database? Control business logic? Store
> in a file? Render in browser? Some other interpreter?

Quite so. But CDATA doesn't make things any worse. Forbidding it is
like forbidding attribute values to be surrounded by apostrophes,
or forbidding CR/LF line terminators, or forbidding the use of
English-language character content. There's no factual basis for it.

--
Business before pleasure, if not too bloomering long before.
--Nicholas van Rijn
John Cowan <cowan AT ccil.org>
http://www.ccil.org/~cowan




Archive powered by MHonArc 2.6.24.

Top of Page