XOM API for Processing XML with Java

[Elliotte Harold <elharo AT metalab.unc.edu>]

Jeff Williams wrote:
> > Exactly which piece of software would be confused by the above
> > "obfuscation" but would successfully protect against:
> >
> >   <IMG SRC="javascript:alert('XSS');">
>
> Any browser.

Well, that depends. Some browsers will handle both securely provided the 
 file is served as application/xhtml+xml and therefore a real XML 
parser is used on the document.

If the file is served to a browser that does not support XML, or is 
served with MIME type text/html, then most browsers will not use an XML 
parser top handle the content.

As I've said repeatedly, if you're not using an XML parser on XML 
content, then security may be compromised. (Thanks for the practical 
example of just how this could happen though.)


--
Elliotte Rusty Harold  elharo AT metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/