[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: Interesting mailing list & a rare broadside

  • To: "James Clark" <jjc@j...>,<xml-dev@l...>
  • Subject: RE: Interesting mailing list & a rare broadside
  • From: "Dare Obasanjo" <dareo@m...>
  • Date: Fri, 7 Jun 2002 20:40:25 -0700
  • Thread-index: AcIOnWws7O594h/gTUWBLMclMSmDEgAAECfw
  • Thread-topic: Interesting mailing list & a rare broadside

RE:  Interesting mailing list & a rare broadside
> -----Original Message-----
> From: James Clark [mailto:jjc@j...] 
> Sent: Friday, June 07, 2002 8:35 PM
> To: Dare Obasanjo; xml-dev@l...
> Subject: RE:  Interesting mailing list & a rare broadside
> So, are you saying that the answer to my question is 
> basically "no", since 
> there is always the possibility that the root element of the 
> instance will 
> use a namespace not in the schema cache?
> If that's so, although it's perfectly conformant, it seems 
> like a fairly 
> major potential security/robustness hole.  Suppose an 
> application is trying 
> to use validation to protect itself from bad input. It 
> carefully loads the 
> schema cache with the namespaces it knows about, and calls 
> validate().  Now 
> the bad guy comes along and uses a root element from some 
> other namespace 
> and uses xsi:schemaLocation to point to his own schema that 
> that has a 
> declaration for that element and uses <xs:any namespace="##any" 
> processContents="skip"/>.  Won't they just have almost completely 
> undermined any protection that was supposed to come from validation?

That is an interesting theoretical attack which I don't think anything
in the W3C XML Schema recommendation prevents. You bring up a good point
which I'll have to discuss with our resident W3C XML Schema folks when
they get in on Monday. 
The shortest distance between two points is under repair.

This posting is provided "AS IS" with no warranties, and confers no


Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
First Name
Last Name
Subscribe in XML format
RSS 2.0
Atom 0.3

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.

Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.