[
Lists Home |
Date Index |
Thread Index
]
At 9:08 AM -0500 2/21/03, Karl Waclawek wrote:
>There is one reason that is valid, IMO, and that is to prevent
>"a million laughs" attacks.
This is not a decision that should be made at the parser level
though. Parsers do need to process documents that contain document
type declarations. No one should ship a parser that simply gives up
when it encounters a document type declaration.
An application such as SOAP may decide it doesn't want to accept
document type declarations, and reject documents that contain them,
perhaps to avoid the billion laughs attack, perhaps for other
reasons. I still think that's a bad idea, but it's not nearly as bad
an idea as what's happening in JSR 172. This is turning up the
subsetting a notch. Now the parser is making the decision to reject
documents that contain document type declarations rather than the
application using the parser. SOAP's mistake only affects SOAP. This
affects everybody using that parser for any application.
In brief, the SOAP subset is now infecting the rest of XML. This
needs to be stopped.
--
+-----------------------+------------------------+-------------------+
| Elliotte Rusty Harold | elharo@metalab.unc.edu | Writer/Programmer |
+-----------------------+------------------------+-------------------+
| Processing XML with Java (Addison-Wesley, 2002) |
| http://www.cafeconleche.org/books/xmljava |
| http://www.amazon.com/exec/obidos/ISBN%3D0201771861/cafeaulaitA |
+----------------------------------+---------------------------------+
| Read Cafe au Lait for Java News: http://www.cafeaulait.org/ |
| Read Cafe con Leche for XML News: http://www.cafeconleche.org/ |
+----------------------------------+---------------------------------+
|
