XOM API for Processing XML with Java

[Wolfgang Hoschek <wolfgang.hoschek AT mac.com>]

>

> > Which was the right answer. You're advocating a "blacklist" kind of
> > security which doesn't work. A "positive" or "whitelist" security  
> > model
> > (where you deny everything and create exceptions for the things  
> > you know
> > should be allowed) is generally simpler and much more secure.

Sounds entirely reasonable. I'd add that an "all or nothing" (either  
you let XML in or not) security model is inferior to a multi-layered  
model (if layer 1 breaks, there's still layer 2 .. N left as  
defense). It's another way of saying that practical security isn't  
about making successful attacks impossible (you can't - get over it).  
It's about making them as difficult as possible. Talk to folks who  
run data centers.

This leaves the question of how to reasonably balance security vs.  
accessability/usability. I'm not aware of easy answers but certainly  
religious denial won't help.

> > Readers of the list might be interested in XML attacks like
> > http://www.owasp.org/index.php/Blind_XPath_Injection
> > http://www.owasp.org/index.php/XML_Injection
>
> FUD. That has nothing to do with the issue at hand.

XPath injection (i.e. a query that is formed by plain string  
concatenation of query template and user provided string) is a  
different problem, but potentially serious nonetheless, just as SQL  
injection is. As in SQL and other languages, the typical defense is  
to use a compiled query with explicit variables rather than a query  
that consists of concatenated user provided strings. Example:

/books/book[@name = $bookName]/author[@name = $authorName]

The key aspect is that with explicit variables, $bookName and  
$authorName can't be interpreted as "executable content". Execution  
logic and data are strictly separated.

Example file myquery.xq:

declare variable $bookName as xs:string external;
declare variable $authorName as xs:string external;
/books/book[@name = $bookName]/author[@name = $authorName]


Example Java code for Nux:

Document doc = new Builder().build("/tmp/books.xml");
XQuery xquery = new XQueryFactory().createXQuery(new File("/tmp/ 
myquery.xq"));
Map vars = new HashMap();
vars.put("bookName", "All about nothing");
vars.put("authorName", "nobody");
Nodes results = xquery.execute(doc, null, vars).toNodes();
for (int i=0; i < results.size(); i++) {
   System.out.println(results.get(i).toXML());
}

Wolfgang.