OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   Re: [xml-dev] Seen on BugTraq: XXE (Xml eXternal Entity) attack

[ Lists Home | Date Index | Thread Index ]

Rick Jelliffe wrote,
> From: "Miles Sabin" <miles@milessabin.com>
>  > Read it carefully: "In case of *untrusted* XML input it is best
>  > ...".
> >
> > The qualifier is important.
> >
> > To all intents and purposes a list which specifies trusted sources
> > is an ACL.
> Miles' ACLs say "These document are trusted, so they can access any
> entities". It is a list (simplification) of documents that can make
> references.
> My ACLs say "These entities can be accessed by any document".
> It is a list (simplification) of documents that can be referred to,
> enforced by a parser's entity manager.
> Not the same thing at all, though certainly there may be scope for
> both. I don't see how Miles' ACLs prevent the attacks suggested. 
> (But I don't deny that different levels of security are appropriate
> for different levels of danger!)

Umm ... actually I was saying exactly the same thing as you! Ie. an ACL 
referenced by an EntityResolver. I certainly didn't mean: automatically 
trust URIs in documents received from trusted sources.

I think we're just reading Gregory Steuck's recommendation differently.
I read "XML input" in "In case of untrusted XML input it is best to 
prohibit all external general entities" as covering the external 
entities as well as the referencing document.

Hmm ... OK, maybe my reading is a bit too generous.




News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS