[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Malicious documents? (WAS: Interesting mailing list & a r

• To: xml-dev@l...
• Subject: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• From: Miles Sabin <miles@m...>
• Date: Mon, 10 Jun 2002 12:52:21 +0100
• In-reply-to: <008301c21073$86fee390$0400a8c0@scott>
• References: <000a01c20ecc$90ebb980$887ba8c0@mitchum> <200206101007.58939.miles@m...> <008301c21073$86fee390$0400a8c0@scott>

Rob Lugt wrote,
> Miles Sabin wrote
> > Which means that even if developers are aware that they ought to
> > disable external entity retrieval, and are aware of how to do it,
> > they have no guarantee that it'll actually happen.
>
> Sure they do.  If the SAX parser they are using doesn't support the
> feature, then they'll get an UnsupportedFeatureException when they
> try to set it.

But then we have a slightly different problem. Developers who try to do 
the right thing will be hit by interoperability issues. Either that or 
they have to specify a particular (set of) SAX implementation(s) which 
somewhat undermines SAX as a common API.

On reflection, I think that SAX should be tweaked to at least require 
support for this feature, and maybe mandate that the default be to not 
retrieve external entities.

Cheers,


Miles

• Follow-Ups:
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: "Rob Lugt" <roblugt@e...>

• References:
  • RE: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Bill de hÓra <dehora@e...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: "Rob Lugt" <roblugt@e...>

• Prev by Date: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by Date: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Previous by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Index(es):
  • Date
  • Thread