OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   Re: [xml-dev] The subsetting has begun

[ Lists Home | Date Index | Thread Index ]

At 9:08 AM -0500 2/21/03, Karl Waclawek wrote:

>There is one reason that is valid, IMO, and that is to prevent
>"a million laughs" attacks.

This is not a decision that should be made at the parser level 
though. Parsers do need to process documents that contain document 
type declarations. No one should ship a parser that simply gives up 
when it encounters a document type declaration.

An application such as SOAP may decide it doesn't want to accept 
document type declarations, and reject documents that contain them, 
perhaps to avoid the billion laughs attack, perhaps for other 
reasons. I still think that's a bad idea, but it's not nearly as bad 
an idea as what's happening in JSR 172. This is turning up the 
subsetting a notch. Now the parser is making the decision to reject 
documents that contain document type declarations rather than the 
application using the parser. SOAP's mistake only affects SOAP. This 
affects everybody using that parser for any application.

In brief, the SOAP subset is now infecting the rest of XML. This 
needs to be stopped.

| Elliotte Rusty Harold | elharo@metalab.unc.edu | Writer/Programmer |
|           Processing XML with Java (Addison-Wesley, 2002)          |
|              http://www.cafeconleche.org/books/xmljava             |
| http://www.amazon.com/exec/obidos/ISBN%3D0201771861/cafeaulaitA  |
|  Read Cafe au Lait for Java News:  http://www.cafeaulait.org/      |
|  Read Cafe con Leche for XML News: http://www.cafeconleche.org/    |


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS