[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Internal entities removed from XML?


soap entities
On Thu, 19 Dec 2002 17:56:00 +0000, Bill de hÓra <bill.dehora@p...> 
wrote:

>
>
> I'm not asking for the feature to be removed, just make the default 
> setting compliant with XML. If you don't want entities expanded, turn 
> them off. Having to turn them on frankly breaks with the spirit of 
> things.
>

Upon reflection, I guess I am very ambivalent, but tending toward being 
convinced by the arguments here. The only compelling reasons for defaulting 
to "no entities" that I can think of are a) the statistical likelihood that 
external entities will cause problems; and b) the billion laughs DOS 
attack.   I have no idea if the latter was part of MS's design decision, 
but http://online.securityfocus.com/archive/1/303509/2002-12-13/2002-12- 
19/0 does suggest "If possible, disable DTD in the XML parser. This 
requires raw access to the XML parser API, which is usually impossible for 
Web Services applications."  (Of course, a SOAP message shouldn't have a 
DTD in the first place, but, ahem, "be liberal in what you consume" ...).

 Still, on balance, the argument that "System.XML should play by the XML 
rules rather than the SOAP rules, define a System.SOAP if you want to 
expose the SOAP rules" is pretty persuasive.  But I guess I don't think of 
this as a black/white compliant/non-compliant issue, but just another one 
of the shades-of-grey things we have to deal with.  I'm frankly glad I 
don't have to make the decision!   Damned if you appear to be non- 
compliant, double-damned if your customers get hit with some (accidental or 
deliberate) performance hit from a recursive entity expansion scenario. 


PURCHASE STYLUS STUDIO ONLINE TODAY!

Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
Email
First Name
Last Name
Company
Subscribe in XML format
RSS 2.0
Atom 0.3
 

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.


Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.