Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: "Jeff Williams" <jeff.williams AT aspectsecurity.com>
  • To: <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 5
  • Date: Mon, 11 Dec 2006 14:21:28 -0500

> I've dealt with their type before. Presumably, they're afraid of the
dark, since they
> don't know what's in there. I've actually got one to admit he was
trying to protect
> against "the unknown."

Which was the right answer. You're advocating a "blacklist" kind of
security which doesn't work. A "positive" or "whitelist" security model
(where you deny everything and create exceptions for the things you know
should be allowed) is generally simpler and much more secure. See
http://www.owasp.org/index.php/Category:Principle for discussion of this
and other application security principles.

Readers of the list might be interested in XML attacks like
http://www.owasp.org/index.php/Blind_XPath_Injection
http://www.owasp.org/index.php/XML_Injection

--Jeff






Archive powered by MHonArc 2.6.24.

Top of Page