[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Malicious documents? (WAS: Interesting mailing list & a ra

• To: xml-dev@l...
• Subject: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• From: "Simon St.Laurent" <simonstl@s...>
• Date: Mon, 10 Jun 2002 09:33:18 -0400
• In-reply-to: <200206081124.18653.miles@m...>
• References: <3D01D65D.40909@d...><000a01c20ecc$90ebb980$887ba8c0@mitchum><200206081044.42559.miles@m...><3D01D65D.40909@d...>

David Megginson had a nice piece to this effect a few years ago:
http://www.megginson.com/ugly/index.html

"When XML Turns Ugly"

This was pre-schema, and still largely client-oriented, but has a lot of 
interesting pieces on the dangers of XML processing.

At 11:24 AM 6/8/2002 +0100, Miles Sabin wrote:
>Yes it is, but it's now pretty widely understood that HTML (with or
>without embedded scripts or objects) can be dangerous on the client.
>
>I don't think there's the same understanding of vulnerabilities on the
>server side: if you POST and HTML document to a server you wouldn't
>normally expect it to attempt to retrieve images or execute embedded
>scripts or objects. OTOH, with an XML POST to a validating XML
>processor, retrieval of referenced external enities is precisely what's
>going to happen in many cases.

Simon St.Laurent
"Every day in every way I'm getting better and better." - Emile Coue

• Follow-Ups:
  • RE: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: "Michael Kay" <michael.h.kay@n...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>

• References:
  • Re: Malicious documents? (WAS: Interesting mailing list& a rare broadside)
    • From: Eric van der Vlist <vdv@d...>
  • RE: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Bill de hÓra <dehora@e...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>

• Prev by Date: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by Date: Re: Interesting mailing list & a rare broadside
• Previous by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Index(es):
  • Date
  • Thread