XOM API for Processing XML with Java

[John Cowan <cowan AT ccil.org>]

Jeff Williams scripsit:

> The point is that it's easy to send around attacks inside XML that's
> well-formed and validated. If a security person is concerned about
> what's actually inside, good. They need to make sure the data is safe
> enough to use. Is it going to a database? Control business logic? Store
> in a file? Render in browser?  Some other interpreter?

Quite so.  But CDATA doesn't make things any worse.  Forbidding it is
like forbidding attribute values to be surrounded by apostrophes,
or forbidding CR/LF line terminators, or forbidding the use of
English-language character content.  There's no factual basis for it.

-- 
Business before pleasure, if not too bloomering long before.
        --Nicholas van Rijn
                John Cowan <cowan AT ccil.org>
                    http://www.ccil.org/~cowan