[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: XInclude: security risk 1

• To: Richard Tobin <richard@c...>
• Subject: Re: XInclude: security risk 1
• From: Elliotte Rusty Harold <elharo@m...>
• Date: Mon, 28 Oct 2002 12:56:54 -0500
• Cc: xml-dev@l...
• In-reply-to: <200210281738.RAA22191@s...>
• References: <200210281738.RAA22191@s...>

>On reflection, I think XInclude's security issues are really just a
>subset of those that browsers have with XSLT, or at least are solvable
>in the same way.  XSLT allows you to fetch data from a local file
>using document("file:///whatever") and even allows you to pass out
>that information as part of a URL in another document() call.

You're right. That does sound like another security hole, and 
possibly worse. It also had not occurred to me that you might 
XInclude a file URL. That opens up some more holes.

>I checked what Mozilla does in this case, and it appears to refuse
>to fetch a file: URL from a document() call in a remote stylesheet.

Which raises the questions:

1. What does IE6 do?
2. What does Mozilla do when faced with an http URL in the document() 
function that points to a host other than the document base?

The XSLT issue is potentially worse because you could use XSLT to 
actually include the contents of the stolen XML document in the URL 
you passed back to the hacker's server. It is somewhat (though far 
from completely) mitigated by the fact that the document() function 
can only point to well-formed XML documents so it can't steal 
absolutely any file or URL.
-- 

+-----------------------+------------------------+-------------------+
| Elliotte Rusty Harold | elharo@m... | Writer/Programmer |
+-----------------------+------------------------+-------------------+
|          XML in a  Nutshell, 2nd Edition (O'Reilly, 2002)          |
|              http://www.cafeconleche.org/books/xian2/              |
|  http://www.amazon.com/exec/obidos/ISBN%3D0596002920/cafeaulaitA/  |
+----------------------------------+---------------------------------+
|  Read Cafe au Lait for Java News:  http://www.cafeaulait.org/      |
|  Read Cafe con Leche for XML News: http://www.cafeconleche.org/    |
+----------------------------------+---------------------------------+

• Follow-Ups:
  • Re: XInclude: security risk 1
    • From: Richard Tobin <richard@c...>

• References:
  • Re: XInclude: security risk 1
    • From: Richard Tobin <richard@c...>

• Prev by Date: Re: XInclude: security risk 1
• Next by Date: RE: ANN: xpath1() scheme for XPointer
• Previous by thread: Re: XInclude: security risk 1
• Next by thread: Re: XInclude: security risk 1
• Index(es):
  • Date
  • Thread