[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack

• To: xml-dev@l...
• Subject: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• From: Miles Sabin <miles@m...>
• Date: Wed, 30 Oct 2002 10:17:21 +0000
• In-reply-to: <01ad01c27ffb$9aa10d40$4bc8a8c0@A...>
• References: <200210300905.44376.miles@m...> <01ad01c27ffb$9aa10d40$4bc8a8c0@A...>

Rick Jelliffe wrote,
> It strikes me that this puts the cart before the horse.  The answer
> is not to ban external entities, it is to allow access control lists
> as part of entity managers or URL resolvers.

Sure, but isn't that tantamount to agreeing with,

  Suggested fix:
   Most XML parsers allow their user to explicitly specify external
   entity handler. In case of untrusted XML input it is best to prohibit
   all external general entities.

because your ACL will effectively be whitelisting your *trusted* 
sources.

Cheers,


Miles

• Follow-Ups:
  • Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: "Rick Jelliffe" <ricko@a...>

• References:
  • Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: Miles Sabin <miles@m...>
  • Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
    • From: "Rick Jelliffe" <ricko@a...>

• Prev by Date: Re: XML Object Serialization
• Next by Date: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• Previous by thread: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• Next by thread: Re: Seen on BugTraq: XXE (Xml eXternal Entity) attack
• Index(es):
  • Date
  • Thread