It’s time to take XML out back and shoot it

XML Anxiety

Article from Issue 150/2013
Author(s):

XML security problems are numerous, but you can take steps to limit your exposure – or you can use a different standard.

For this month’s column, I intended to write about XML security and how to avoid all the attacks and problems that can occur. I started making a list of issues both well known and not so well known. After listing 20 items, I realized I wouldn’t have enough space to cover everything, so I moved on to plan B: Instead of focusing on the problems, I’d look at the solutions. This worked reasonably well until I realized one small problem: Even if you use software like Python’s new defusedxml and defusedexpat a number of problems are still difficult to deal with.

A Brief History of XML

XML came from the W3C (World Wide Web Consortium), who also brought us SGML (from which XML comes), SOAP, HTML, you name it. To say that XML and its related family of standards is complicated is a gross understatement – with XML, XML Schema, RELAX NG, XPath, XSLT, XML Signatures, and XML Encryption to name a few. XML also has been extended into XHTML, RSS, Atom, and KML, to name a few more standards. About the only good news I have is that XML and most of its family of standards are NOT Turing complete (unlike, say, PostScript), but you can embed some pretty funky logic into XML files that can cause problems in the various XML parsers.

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Security Lessons: Web Apps

    A few tools and tricks can find and correct web app vulnerabilities.

  • Critical Security Vulnerabilities

    We look at what makes a security issue critical and how upstream developers and vendors respond by examining three incidents: CVE-2013-0156, CVE-2013-0333, and rubygems.org. incident response handling.

  • Security Lessons

    Our security guy looks at software tools that you can use to audit and secure your software.

  • Security Lessons: Web Frameworks

    Stop re-inventing the wheel and build your web applications with the excellent tools already available.

  • Index Search with Lucene

    Even state-of-the-art computers need to use clever methods to process ever-increasing amounts of document data. The open source Lucene framework uses inverted indexing for fast searches of document collections.

comments powered by Disqus

Direct Download

Read full article as PDF:

058-059_kurt.pdf (193.44 kB)

News

njobs Europe
What:
Where:
Country:
Njobs Netherlands Njobs Deutschland Njobs United Kingdom Njobs Italia Njobs France Njobs Espana Njobs Poland
Njobs Austria Njobs Denmark Njobs Belgium Njobs Czech Republic Njobs Mexico Njobs India Njobs Colombia