[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Extra headaches of securing XML

• To: Tim Bray <tbray@t...>
• Subject: Re: Extra headaches of securing XML
• From: Rich Salz <rsalz@d...>
• Date: Tue, 30 Mar 2004 13:10:10 -0500
• Cc: "Bullard, Claude L (Len)" <clbullar@i...>, "'Hunsberger, Peter'" <Peter.Hunsberger@s...>, xml-dev@l..., Gerben Rampaart <VisualBasic@H...>
• In-reply-to: <B264C3DB-8272-11D8-A66F-000A95A51C9E@t...>
• References: <15725CF6AFE2F34DB8A5B4770B7334EE03F9F547@h...> <B264C3DB-8272-11D8-A66F-000A95A51C9E@t...>
• User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

> and I'd bet a zillion bucks that there are awful vulnerabilities lurking 
> in the cracks where nobody could possibly have thought to look.  -Tim

There are some that are inherent in XML itself: entities for example, 
and the fact that there are no size limits (element name with 1e6 
characters, or 1e6 attributes, or a document 1e6 elements deep). This 
makes XML inherently more "dangerous" than classic binary formats like 
ASN.1/DER.

There are some dangerous corners when you mix and match various XML 
technologies.  For example, just because the incoming message 
schema-validates doesn't mean that (a) you have the right schema (does 
your verifier just blindly trust xsi:schemaLocation attributes)?, or (b) 
that it's really secure (does your schema limit xsd:string such that SQL 
injection atttacks are prohibitied).

There are areas to be concerned when exposing (transactional) 
back-office systems to the looser mix of XML and Web technologies, 
causing trade-offs to perhaps be made in the "wrong" direction.  Len 
alluded to this in his usual elliptical style. :)

Hope this helps.
	/r$

-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html
XML Security Overview  http://www.datapower.com/xmldev/xmlsecurity.html

• Follow-Ups:
  • Re: Extra headaches of securing XML
    • From: Gregory Murphy <Gregory.Murphy@e...>
  • Re: Extra headaches of securing XML
    • From: Bob Foster <bob@o...>

• References:
  • RE: Extra headaches of securing XML
    • From: "Bullard, Claude L (Len)" <clbullar@i...>
  • Re: Extra headaches of securing XML
    • From: Tim Bray <tbray@t...>

• Prev by Date: Re: Extra headaches of securing XML
• Next by Date: RE: Extra headaches of securing XML
• Previous by thread: Re: Extra headaches of securing XML
• Next by thread: Re: Extra headaches of securing XML
• Index(es):
  • Date
  • Thread