XOM API for Processing XML with Java

[Elliotte Harold <elharo AT metalab.unc.edu>]

Jeff Williams wrote:

> Gosh, I guess it's impossible to attack anything with XML in it. I'm
> going to upgrade my rainbow- and puppy-based security system to "happy
> thoughts 2.0", now with XML.

It's certainly not possible to attack any real XML system by using CDATA 
unless you can carry out the same attack without using CDATA. Now if the 
system is only pretending to use XML it's a different story.

> So what if the parser is better? The point is that it's easy to send
> around attacks inside XML that's well-formed and validated. 

No, it's not. It's certainly nowhere near as easy as sending an attack 
inside a Word file, for example. XML documents and parsers have a 
characteristic non-parser based solutions don't. Their behavior is 
deterministic. They have well-defined, reliable error behavior.

> If a
> security person is concerned about what's actually inside, good. They
> need to make sure the data is safe enough to use. Is it going to a
> database? Control business logic? Store in a file? Render in browser?
> Some other interpreter?

I don't think you understand what's going on here. If a security person 
wants to look inside the file, they need to use an XML parser. Assuming 
they do that, the presence or absence of CDATA sections is irrelevant. 
If they don't use an XML parser, though, then they've created an 
insecure solution that may be vulnerable to buffer overflows and does 
offer a lot of ways to slip data by them.

--
Elliotte Rusty Harold  elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/