XOM API for Processing XML with Java

["Jeff Williams" <jeff.williams AT aspectsecurity.com>]

> I've dealt with their type before. Presumably, they're afraid of the
dark, since they
> don't know what's in there. I've actually got one to admit he was
trying to protect
> against "the unknown."

Which was the right answer. You're advocating a "blacklist" kind of
security which doesn't work. A "positive" or "whitelist" security model
(where you deny everything and create exceptions for the things you know
should be allowed) is generally simpler and much more secure. See
http://www.owasp.org/index.php/Category:Principle for discussion of this
and other application security principles.

Readers of the list might be interested in XML attacks like
http://www.owasp.org/index.php/Blind_XPath_Injection
http://www.owasp.org/index.php/XML_Injection

--Jeff