[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: Malicious documents? (WAS: Interesting mailing list & a r

• To: "'Simon St.Laurent'" <simonstl@s...>,<xml-dev@l...>
• Subject: RE: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• From: "Michael Kay" <michael.h.kay@n...>
• Date: Mon, 10 Jun 2002 15:38:27 +0100
• Importance: Normal
• In-reply-to: <4.2.0.58.20020610093042.03275f08@p...>
• Reply-to: <michael.h.kay@n...>

I see that David's talk mentions the dangers of referring to external
XSLT stylesheets. Until recently the W3C site provided a servlet which
would run an XSLT transformation using a user-specified source document
and stylesheet. By calling external Java methods from the stylesheet,
you had total access to files on the web server.

Although W3C have patched their servlet to disallow Java method calls, I
suspect many others are still doing this.

Michael Kay

> -----Original Message-----
> From: Simon St.Laurent [mailto:simonstl@s...] 
> Sent: 10 June 2002 14:33
> To: xml-dev@l...
> Subject: Re:  Malicious documents? (WAS: Interesting 
> mailing list & a rare broadside)
> 
> 
> David Megginson had a nice piece to this effect a few years 
> ago: http://www.megginson.com/ugly/index.html
> 
> "When XML Turns Ugly"
> 
> This was pre-schema, and still largely client-oriented, but 
> has a lot of 
> interesting pieces on the dangers of XML processing.
> 
> At 11:24 AM 6/8/2002 +0100, Miles Sabin wrote:
> >Yes it is, but it's now pretty widely understood that HTML (with or 
> >without embedded scripts or objects) can be dangerous on the client.
> >
> >I don't think there's the same understanding of 
> vulnerabilities on the 
> >server side: if you POST and HTML document to a server you wouldn't 
> >normally expect it to attempt to retrieve images or execute embedded 
> >scripts or objects. OTOH, with an XML POST to a validating XML 
> >processor, retrieval of referenced external enities is 
> precisely what's 
> >going to happen in many cases.
> 
> Simon St.Laurent
> "Every day in every way I'm getting better and better." - Emile Coue
> 
> 
> -----------------------------------------------------------------
> The xml-dev list is sponsored by XML.org 
> <http://www.xml.org>, an initiative of OASIS 
<http://www.oasis-open.org>

The list archives are at http://lists.xml.org/archives/xml-dev/

To subscribe or unsubscribe from this list use the subscription
manager: <http://lists.xml.org/ob/adm.pl>

• Follow-Ups:
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Henrik Motakef <henrik.motakef@w...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>

• References:
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: "Simon St.Laurent" <simonstl@s...>

• Prev by Date: RE: W3C Schema: Resistance is Futile, says Don Box
• Next by Date: RE: W3C Schema: Resistance is Futile, says Don Box
• Previous by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Index(es):
  • Date
  • Thread