XOM API for Processing XML with Java

[John Cowan <cowan AT ccil.org>]

Wolfgang Hoschek scripsit:

> With such a layered approach, the strength of security is a function
> of the length of the chain rather than it's weakest link. The  
> probability of a CDATA exploit happening someday somewhere somehow is  
> possibly small but it is non-zero (unless religion is involved), thus  
> forbidding CDATA does reduce risk.

On this argument, forbidding attributes (which are definitely on
a completely separate code path) would raise security even more than
forbidding CDATA.

And of course nothing can be done with attributes that can't be
done with child elements.

> A conservative risk management approach doesn't forbid what's known  
> to be insecure but instead allows what's known to be secure and  
> forbids everything else.

Unfortunately, there is *nothing* that is actually *known* to be secure
except the aforementioned "air-gap firewall".  All security can do is
lock doors until someone from the business side comes along and insists
that a particular door remain open.

-- 
LEAR: Dost thou call me fool, boy?      John Cowan
FOOL: All thy other titles              http://www.ccil.org/~cowan
             thou hast given away:      cowan AT ccil.org
      That thou wast born with.