XOM API for Processing XML with Java

["Jeff Williams" <jeff.williams AT aspectsecurity.com>]

Elliotte Harold wrote:

>> Which was the right answer. You're advocating a "blacklist" kind of
>> security which doesn't work. A "positive" or "whitelist" security
model
>> (where you deny everything and create exceptions for the things you
know
>> should be allowed) is generally simpler and much more secure. 
>
> Either you let in XML or you don't. If you do let it in the robust 
> nature of well-formedness and optional validity checking, means XML 
> solutions are more secure. I'm much more confident with an XML system 
> than I am with anything hand-rolled, including fake XML parsers. 

Gosh, I guess it's impossible to attack anything with XML in it. I'm
going to upgrade my rainbow- and puppy-based security system to "happy
thoughts 2.0", now with XML.

So what if the parser is better? The point is that it's easy to send
around attacks inside XML that's well-formed and validated. If a
security person is concerned about what's actually inside, good. They
need to make sure the data is safe enough to use. Is it going to a
database? Control business logic? Store in a file? Render in browser?
Some other interpreter?

So don't add a feature to XOM - I don't care. But just because you've
received "valid" XML doesn't mean you should trust it.

--Jeff