Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] Control output of CDATA sections

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: "Steve Loughran" <steve.loughran AT gmail.com>
  • Cc: xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] Control output of CDATA sections
  • Date: Mon, 11 Dec 2006 15:57:14 +0000

On 11/12/06, Hughes, Rob <hughes AT fgm.com> wrote:
Elliotte,

Thanks for the response.

For the curious, it is not the consuming application that is broken. I have
an application which transmits XML documents across security domains. The
security folks have decreed that CDATA sections are not allowed due to an
unspecified risk.

--Rob

Let's get this right. They're happy to use the OSS XML parser built
into Java, a parser that is so big and complex that if I wanted to
hide a back door in it I could do it by creating a special bit of XML
Schema processing logic so that every XSD: enumeration type in the
xmlns http://backdoor/ would be executed on the command line, yet they
dont want CDATA
.

I despair; I've worked with ops teams like that too. the ones who dont
let developers near production systems as they dont trust us, they
have to rebuild the source from scratch in case we've been malicious,
yet the idiots build the app using ant+xerces which is where I'd put
the back door in if I wanted to.

Maybe it is a fear of having a null byte in the payload and the
corresponding risk of buffer overflow, but as CDATA still bans that, I
can't see it.

-steve




Archive powered by MHonArc 2.6.24.

Top of Page