XOM API for Processing XML with Java

[Wolfgang Hoschek <wolfgang.hoschek AT mac.com>]

On Dec 11, 2006, at 1:36 PM, Elliotte Harold wrote:

> Jeff Williams wrote:
>
> > Gosh, I guess it's impossible to attack anything with XML in it. I'm
> > going to upgrade my rainbow- and puppy-based security system to  
> > "happy
> > thoughts 2.0", now with XML.
>
> It's certainly not possible to attack any real XML system by using  
> CDATA
> unless you can carry out the same attack without using CDATA.

That's a claim with some adhoc reasoning behind it, but not anywhere  
near a proof. Indeed, I'd be surprised if a credible proof emerged.  
One day we could see the claim falsified by, say, a buffer overflow  
exploit specific to CDATA in libxml or some other parser. Again, let  
me repeat that this isn't about theory and "certainty" but about  
practise:

An "all or nothing" (e.g. either you let XML in or not) security  
model is inferior to a multi-layered
model (if layer 1 breaks, there's still layer 2 .. N left as
defense). It's another way of saying that practical security isn't
about making successful attacks impossible (you can't - get over it).
It's about making them as difficult as possible. Talk to folks who
run data centers.


> Now if the
> system is only pretending to use XML it's a different story.
>
> > So what if the parser is better? The point is that it's easy to send
> > around attacks inside XML that's well-formed and validated.
>
> No, it's not. It's certainly nowhere near as easy as sending an attack
> inside a Word file, for example. XML documents and parsers have a
> characteristic non-parser based solutions don't. Their behavior is
> deterministic.

Unless it isn't defined or well defined. E.g. in the presence of  
recursive external entities and other bizarre corner cases.

> They have well-defined, reliable error behavior.

Unless they have a bug, which they all tend to do, in one way or  
another.
Again, anectdotal evidence isn't enough to make any claim about  
definite absence of a security vector.

Look, I'm not avdocating scare mongering, but I'd like to point out  
that approaching security with a mindset that tries to establish  
absolute certainty, proof, and the like, is at best a fragile fantasy  
and at worst a source of (costly) later security problems.

Wolfgang.