[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: The subsetting has begun

• To: "Karl Waclawek" <karl@w...>, <xml-dev@l...>
• Subject: Re: The subsetting has begun
• From: Elliotte Rusty Harold <elharo@m...>
• Date: Fri, 21 Feb 2003 10:13:00 -0500
• In-reply-to: <002101c2d9b2$af553c00$0207a8c0@karl>
• References: <p04330103ba7bc5789998@[192.168.254.4]><oprkx5k21bezizxn@s...><p04330105ba7be01cdbea@[192.168.254.4]><002101c2d9b2$af553c00$0207a8c0@karl>

At 9:08 AM -0500 2/21/03, Karl Waclawek wrote:

>There is one reason that is valid, IMO, and that is to prevent
>"a million laughs" attacks.

This is not a decision that should be made at the parser level 
though. Parsers do need to process documents that contain document 
type declarations. No one should ship a parser that simply gives up 
when it encounters a document type declaration.

An application such as SOAP may decide it doesn't want to accept 
document type declarations, and reject documents that contain them, 
perhaps to avoid the billion laughs attack, perhaps for other 
reasons. I still think that's a bad idea, but it's not nearly as bad 
an idea as what's happening in JSR 172. This is turning up the 
subsetting a notch. Now the parser is making the decision to reject 
documents that contain document type declarations rather than the 
application using the parser. SOAP's mistake only affects SOAP. This 
affects everybody using that parser for any application.

In brief, the SOAP subset is now infecting the rest of XML. This 
needs to be stopped.
-- 

+-----------------------+------------------------+-------------------+
| Elliotte Rusty Harold | elharo@m... | Writer/Programmer |
+-----------------------+------------------------+-------------------+
|           Processing XML with Java (Addison-Wesley, 2002)          |
|              http://www.cafeconleche.org/books/xmljava             |
| http://www.amazon.com/exec/obidos/ISBN%3D0201771861/cafeaulaitA  |
+----------------------------------+---------------------------------+
|  Read Cafe au Lait for Java News:  http://www.cafeaulait.org/      |
|  Read Cafe con Leche for XML News: http://www.cafeconleche.org/    |
+----------------------------------+---------------------------------+

• Follow-Ups:
  • Re: The subsetting has begun
    • From: Mike Champion <mc@x...>
  • Re: The subsetting has begun
    • From: "Karl Waclawek" <karl@w...>

• References:
  • The subsetting has begun
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: The subsetting has begun
    • From: Mike Champion <mc@x...>
  • Re: The subsetting has begun
    • From: Elliotte Rusty Harold <elharo@m...>
  • Re: The subsetting has begun
    • From: "Karl Waclawek" <karl@w...>

• Prev by Date: RE: MSXML4 : how to select a element with namespace prefix
• Next by Date: RE: The subsetting has begun
• Previous by thread: Re: The subsetting has begun
• Next by thread: Re: The subsetting has begun
• Index(es):
  • Date
  • Thread