[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Embedding image files in XML using data URLs

  • From: David Carlisle <d.p.carlisle@gmail.com>
  • To: "Costello, Roger L." <costello@mitre.org>
  • Date: Wed, 29 Nov 2017 16:16:52 +0000

Re:  Embedding image files in XML using data URLs

> An xs:anyURI value can be a data URL.

that's hardly surprising given that (in later interpretations of xsd) any string is valid xs:anyURI value.

> An xs:anyURI value can either link to external data or it can inline the data using a data URL.
or said differently   an xsl:anyURI value can refer to a resource by its URI

> A data URL in an XML instance document exposes the recipient of the XML to the risks described above. Namely, link filters can be circumvented and undesirable data can be smuggled in without notice.

shrug, I don't think those risks are particularly the result of anyURI. If you interpret any XML you get from anywhere it's up to you to ensure that that interpretation is safe.

If it was encoded as a string <base64image>wAARCADqATkDASIA....</base64image> then there are no URI involved but you still have to decide whether or not it is safe to decode the base64.and do something with the result.



[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]


Purchasing Stylus Studio from our online shop is Easy, Secure and Value Priced!

Buy Stylus Studio Now

Download The World's Best XML IDE!

Accelerate XML development with our award-winning XML IDE - Download a free trial today!

Don't miss another message! Subscribe to this list today.
First Name
Last Name
Subscribe in XML format
RSS 2.0
Atom 0.3

Stylus Studio has published XML-DEV in RSS and ATOM formats, enabling users to easily subcribe to the list from their preferred news reader application.

Stylus Studio Sponsored Links are added links designed to provide related and additional information to the visitors of this website. they were not included by the author in the initial post. To view the content without the Sponsor Links please click here.

Site Map | Privacy Policy | Terms of Use | Trademarks
Free Stylus Studio XML Training:
W3C Member
Stylus Studio® and DataDirect XQuery ™are products from DataDirect Technologies, is a registered trademark of Progress Software Corporation, in the U.S. and other countries. © 2004-2013 All Rights Reserved.