[
Lists Home |
Date Index |
Thread Index
]
I see that David's talk mentions the dangers of referring to external
XSLT stylesheets. Until recently the W3C site provided a servlet which
would run an XSLT transformation using a user-specified source document
and stylesheet. By calling external Java methods from the stylesheet,
you had total access to files on the web server.
Although W3C have patched their servlet to disallow Java method calls, I
suspect many others are still doing this.
Michael Kay
> -----Original Message-----
> From: Simon St.Laurent [mailto:simonstl@simonstl.com]
> Sent: 10 June 2002 14:33
> To: xml-dev@lists.xml.org
> Subject: Re: [xml-dev] Malicious documents? (WAS: Interesting
> mailing list & a rare broadside)
>
>
> David Megginson had a nice piece to this effect a few years
> ago: http://www.megginson.com/ugly/index.html
>
> "When XML Turns Ugly"
>
> This was pre-schema, and still largely client-oriented, but
> has a lot of
> interesting pieces on the dangers of XML processing.
>
> At 11:24 AM 6/8/2002 +0100, Miles Sabin wrote:
> >Yes it is, but it's now pretty widely understood that HTML (with or
> >without embedded scripts or objects) can be dangerous on the client.
> >
> >I don't think there's the same understanding of
> vulnerabilities on the
> >server side: if you POST and HTML document to a server you wouldn't
> >normally expect it to attempt to retrieve images or execute embedded
> >scripts or objects. OTOH, with an XML POST to a validating XML
> >processor, retrieval of referenced external enities is
> precisely what's
> >going to happen in many cases.
>
> Simon St.Laurent
> "Every day in every way I'm getting better and better." - Emile Coue
>
>
> -----------------------------------------------------------------
> The xml-dev list is sponsored by XML.org
> <http://www.xml.org>, an initiative of OASIS
<http://www.oasis-open.org>
The list archives are at http://lists.xml.org/archives/xml-dev/
To subscribe or unsubscribe from this list use the subscription
manager: <http://lists.xml.org/ob/adm.pl>
|
