XOM API for Processing XML with Java

["Steve Loughran" <steve.loughran AT gmail.com>]

On 11/12/06, Hughes, Rob <hughes AT fgm.com> wrote:
> Elliotte,
>
>   Thanks for the response.
>
> For the curious, it is not the consuming application that is broken. I have 
> an application which transmits XML documents across security domains. The 
> security folks have decreed that CDATA sections are not allowed due to an 
> unspecified risk.
>
> --Rob

Let's get this right. They're happy to use the OSS XML parser built
into Java, a parser that is so big and complex that if I wanted to
hide a back door in it I could do it by creating a special bit of XML
Schema processing logic so that every XSD: enumeration type in the
xmlns http://backdoor/ would be executed on the command line, yet they
dont want CDATA
.

I despair; I've worked with ops teams like that too. the ones who dont
let developers near production systems as they dont trust us, they
have to rebuild the source from scratch in case we've been malicious,
yet the idiots build the app using ant+xerces which is where I'd put
the back door in if I wanted to.

Maybe it is a fear of having a null byte in the payload and the
corresponding risk of buffer overflow, but as CDATA still bans that, I
can't see it.

-steve