[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: The subsetting has begun

• To: <xml-dev@l...>,"Elliotte Rusty Harold" <elharo@m...>
• Subject: Re: The subsetting has begun
• From: "Karl Waclawek" <karl@w...>
• Date: Fri, 21 Feb 2003 10:30:46 -0500
• References: <p04330103ba7bc5789998@[192.168.254.4]> <oprkx5k21bezizxn@s...> <p04330105ba7be01cdbea@[192.168.254.4]> <002101c2d9b2$af553c00$0207a8c0@karl> <p04330106ba7bf115d8f4@[192.168.254.4]>

> At 9:08 AM -0500 2/21/03, Karl Waclawek wrote:
> 
> >There is one reason that is valid, IMO, and that is to prevent
> >"a million laughs" attacks.
> 
> This is not a decision that should be made at the parser level 
> though. Parsers do need to process documents that contain document 
> type declarations. No one should ship a parser that simply gives up 
> when it encounters a document type declaration.

I agree. It would be nice, however, if SAX for instance allowed
an application to stop parsing (based on an event) without 
having to throw an exception.
 
> An application such as SOAP may decide it doesn't want to accept 
> document type declarations, and reject documents that contain them, 
> perhaps to avoid the billion laughs attack, perhaps for other 
> reasons. I still think that's a bad idea, but it's not nearly as bad 
> an idea as what's happening in JSR 172. This is turning up the 
> subsetting a notch. Now the parser is making the decision to reject 
> documents that contain document type declarations rather than the 
> application using the parser. SOAP's mistake only affects SOAP. This 
> affects everybody using that parser for any application.
> 
> In brief, the SOAP subset is now infecting the rest of XML. This 
> needs to be stopped.

Well, I am no friend of XML RPC anyway, so you have my vote there.

Karl

• Follow-Ups:
  • Re: The subsetting has begun
    • From: John Cowan <cowan@m...>

• References:
  • The subsetting has begun
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: The subsetting has begun
    • From: Mike Champion <mc@x...>
  • Re: The subsetting has begun
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: The subsetting has begun
    • From: "Karl Waclawek" <karl@w...>
  • Re: The subsetting has begun
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: Re: The subsetting has begun
• Next by Date: RE: Open Source or Else
• Previous by thread: Re: The subsetting has begun
• Next by thread: Re: The subsetting has begun
• Index(es):
  • Date
  • Thread