XOM API for Processing XML with Java

[Elliotte Harold <elharo AT metalab.unc.edu>]

Jeff Williams wrote:

> Which was the right answer. You're advocating a "blacklist" kind of
> security which doesn't work. A "positive" or "whitelist" security model
> (where you deny everything and create exceptions for the things you know
> should be allowed) is generally simpler and much more secure. 

Either you let in XML or you don't. If you do let it in the robust 
nature of well-formedness and optional validity checking, means XML 
solutions are more secure. I'm much more confident with an XML system 
than I am with anything hand-rolled, including fake XML parsers. 
Subsetting XML to prohibit particular kinds of syntax sugar is just 
asking for security holes. What that tells me is that someone is using a 
non-XML tool to process the XML data, and that is dangerous.

> See
> http://www.owasp.org/index.php/Category:Principle for discussion of this
> and other application security principles.
>
> Readers of the list might be interested in XML attacks like
> http://www.owasp.org/index.php/Blind_XPath_Injection
> http://www.owasp.org/index.php/XML_Injection

FUD. That has nothing to do with the issue at hand.

--
Elliotte Rusty Harold  elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/