Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XPath injection (was: CDATA)

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Wolfgang Hoschek <wolfgang.hoschek AT mac.com>
  • To: Elliotte Harold <elharo AT metalab.unc.edu>
  • Cc: Jeff Williams <jeff.williams AT aspectsecurity.com>, xom-interest AT lists.ibiblio.org
  • Subject: Re: [XOM-interest] XPath injection (was: CDATA)
  • Date: Mon, 11 Dec 2006 12:46:07 -0800



Which was the right answer. You're advocating a "blacklist" kind of
security which doesn't work. A "positive" or "whitelist" security model
(where you deny everything and create exceptions for the things you know
should be allowed) is generally simpler and much more secure.

Sounds entirely reasonable. I'd add that an "all or nothing" (either you let XML in or not) security model is inferior to a multi-layered model (if layer 1 breaks, there's still layer 2 .. N left as defense). It's another way of saying that practical security isn't about making successful attacks impossible (you can't - get over it). It's about making them as difficult as possible. Talk to folks who run data centers.

This leaves the question of how to reasonably balance security vs. accessability/usability. I'm not aware of easy answers but certainly religious denial won't help.


Readers of the list might be interested in XML attacks like
http://www.owasp.org/index.php/Blind_XPath_Injection
http://www.owasp.org/index.php/XML_Injection

FUD. That has nothing to do with the issue at hand.

XPath injection (i.e. a query that is formed by plain string concatenation of query template and user provided string) is a different problem, but potentially serious nonetheless, just as SQL injection is. As in SQL and other languages, the typical defense is to use a compiled query with explicit variables rather than a query that consists of concatenated user provided strings. Example:

/books/book[@name = $bookName]/author[@name = $authorName]

The key aspect is that with explicit variables, $bookName and $authorName can't be interpreted as "executable content". Execution logic and data are strictly separated.

Example file myquery.xq:

declare variable $bookName as xs:string external;
declare variable $authorName as xs:string external;
/books/book[@name = $bookName]/author[@name = $authorName]


Example Java code for Nux:

Document doc = new Builder().build("/tmp/books.xml");
XQuery xquery = new XQueryFactory().createXQuery(new File("/tmp/ myquery.xq"));
Map vars = new HashMap();
vars.put("bookName", "All about nothing");
vars.put("authorName", "nobody");
Nodes results = xquery.execute(doc, null, vars).toNodes();
for (int i=0; i < results.size(); i++) {
System.out.println(results.get(i).toXML());
}

Wolfgang.




Archive powered by MHonArc 2.6.24.

Top of Page