Skip to Content.
Sympa Menu

xom-interest - Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6

xom-interest AT lists.ibiblio.org

Subject: XOM API for Processing XML with Java

List archive

Chronological Thread  
  • From: Elliotte Harold <elharo AT metalab.unc.edu>
  • To: Jeff Williams <jeff.williams AT aspectsecurity.com>
  • Cc: xom-interest <xom-interest AT lists.ibiblio.org>
  • Subject: Re: [XOM-interest] XOM-interest Digest, Vol 47, Issue 6
  • Date: Tue, 12 Dec 2006 10:22:55 -0500

Jeff Williams wrote:
Exactly which piece of software would be confused by the above
"obfuscation" but would successfully protect against:

&lt;IMG SRC="javascript:alert('XSS');">

Any browser.


Well, that depends. Some browsers will handle both securely provided the file is served as application/xhtml+xml and therefore a real XML parser is used on the document.

If the file is served to a browser that does not support XML, or is served with MIME type text/html, then most browsers will not use an XML parser top handle the content.

As I've said repeatedly, if you're not using an XML parser on XML content, then security may be compromised. (Thanks for the practical example of just how this could happen though.)


--
Elliotte Rusty Harold elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/




Archive powered by MHonArc 2.6.24.

Top of Page