XOM API for Processing XML with Java

[Elliotte Harold <elharo AT metalab.unc.edu>]

Jeff Williams wrote:

> Even if the parser is perfect, you can trick applications into including
> attacks in XML documents. Anyone including user data in their XML
> anywhere?
>
> Even if the parser is perfect, these attacks can subvert the
> applications that use the XML. For example, you can send a SQL injection
> attack inside an XML element to a web service that is backed by a
> database. I've found this flaw in several commercial products.
>
> Even if the parser is perfect, XSS attacks inside XML or XML fragments
> can compromise the browser's security. Virtually every "Web 2.0"
> application has this flaw, whether they use REST or SOAP, JSON or XML --
> because a lot of it ends up in the browser eventually.

And this has what to do with the issue of CDATA sections?

> > If a security person wants to look inside the file, they need to use
> an XML parser.
>
> Agreed.  And they get some assurance that the parsing worked.  But they
> get no assurance that the data inside the document is safe to use.


And this has what to do with the issue of CDATA sections?

--
Elliotte Rusty Harold  elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/