[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack

• To: xml-dev@l...
• Subject: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• From: Miles Sabin <miles@m...>
• Date: Wed, 30 Oct 2002 12:44:10 +0000
• In-reply-to: <027b01c2800e$e7423ad0$4bc8a8c0@A...>
• References: <200210300905.44376.miles@m...> <200210301147.40621.miles@m...> <027b01c2800e$e7423ad0$4bc8a8c0@A...>

Rick Jelliffe wrote,
> From: "Miles Sabin" <miles@m...>
>
>  > Read it carefully: "In case of *untrusted* XML input it is best
>  > ...".
> >
> > The qualifier is important.
> >
> > To all intents and purposes a list which specifies trusted sources
> > is an ACL.
>
> Miles' ACLs say "These document are trusted, so they can access any
> entities". It is a list (simplification) of documents that can make
> references.
>
> My ACLs say "These entities can be accessed by any document".
> It is a list (simplification) of documents that can be referred to,
> enforced by a parser's entity manager.
>
> Not the same thing at all, though certainly there may be scope for
> both. I don't see how Miles' ACLs prevent the attacks suggested. 
> (But I don't deny that different levels of security are appropriate
> for different levels of danger!)

Umm ... actually I was saying exactly the same thing as you! Ie. an ACL 
referenced by an EntityResolver. I certainly didn't mean: automatically 
trust URIs in documents received from trusted sources.

I think we're just reading Gregory Steuck's recommendation differently.
I read "XML input" in "In case of untrusted XML input it is best to 
prohibit all external general entities" as covering the external 
entities as well as the referencing document.

Hmm ... OK, maybe my reading is a bit too generous.

Cheers,


Miles

• References:
  • Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: Miles Sabin <miles@m...>
  • Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: Miles Sabin <miles@m...>
  • Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: "Rick Jelliffe" <ricko@a...>

• Prev by Date: Re: Internationalising Regular Expressions
• Next by Date: Re: What is "semantic markup"?
• Previous by thread: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• Next by thread: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• Index(es):
  • Date
  • Thread