[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Why validate? What kind of validation?

• To: <xml-dev@l...>
• Subject: Why validate? What kind of validation?
• From: "Rick Jelliffe" <ricko@a...>
• Date: Sun, 16 Jun 2002 16:05:50 +1000
• References: <200206141022.GAA25900@m...> <010701c21380$1a771a70$4bc8a8c0@A...> <200206141022.GAA25900@m...> <5.1.0.14.0.20020615200648.00ba2270@p...> <3D0BF441.5030606@s...> <004901c214f6$a0b6f390$4bc8a8c0@A...>

For people interested the security/robustness aspects of validation, 
here are two relevant articles

 http://www.kuro5hin.org/?op=displaystory;sid=2002/6/13/114234/914

http://www.acm.org/technews/articles/2002-4/0614f.html#item6

Does anyone know of any list of the most likely/damaging
security problems for XML, and what kinds of validation
would be appropriate to minimise risks?

Also, if a schema language were to specify fallback 
values which would be used when a value was not
valid, would that promote robustness/security
and lessen the need for non-XML properties
(in particular the property related to signalling
validity) in a PSVI? 

For example, if a datatyping spec said (in no particular
schema language)
 <element name="x">
    <datatype name="value"  min="1" fallback="#CRAP" />
  </element>
the schema processing an instance would replace
  <x>0</x>
or
  <x>00000000000000000....times 800 to cause buffer problems</x>
with
  <x>#CRAP</x>

Cheers
Rick Jelliffe

• References:
  • Re: DSDL part 9: new namespace declarations not needed as part of DTD syntax?
    • From: John Cowan <jcowan@r...>
  • DSDL part 9: new namespace declarations not needed as part of DTD syntax?
    • From: "Rick Jelliffe" <ricko@a...>
  • Re: DSDL part 9: new namespace declarations not needed as part of DTD syntax?
    • From: "G. Ken Holman" <gkholman@C...>
  • Re: DSDL part 9: new namespace declarations not neededas part of DTD syntax?
    • From: Dennis Sosnoski <dms@s...>
  • Re: DSDL part 9: new namespace declarations not needed as part of DTD syntax?
    • From: "Rick Jelliffe" <ricko@a...>

• Prev by Date: Re: DSDL part 9: new namespace declarations not needed as part of DTD syntax?
• Next by Date: Re: DSDL part 9: new namespace declarations not neededas part of DTD syntax?
• Previous by thread: Re: DSDL part 9: new namespace declarations not needed as part of DTD syntax?
• Next by thread: Re: DSDL part 9: new namespace declarations not neededas part of DTD syntax?
• Index(es):
  • Date
  • Thread