Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality criteria) are to check for expected type, check for the expected length, check for the expected range and etc...

XML Bombs typically exploits the XML parser in processing the XML DTD or XML Schema. Therefore, I am wondering whether some would be able to help me defining some "quality" criteria for checking that the XML Schema are not vulnerable to, FOR INSTANCE XML Bombs... as similar to the way I mentioned for Input Validation.

Is there any, or what are the best practices in creating XML Schema in order, for instance, to avoid endless loops, or ...

In case there are already some XML Schema security validation tools or APIs as there are for Input Validation against XSS..., also I am interested.

share|improve this question
Can you clarify this some more? I don't understand the security-related question here. What is your threat model? Don't make people try to guess based on your reference to the other question. – nealmcb Jan 20 '11 at 16:18
Description updated – Phoenician-Eagle Jan 20 '11 at 17:22
I find this question confusing. What does XSS have to do with XML bombs? What are the entire first and paragraphs saying? If we delete the entire first paragraph and last paragraph, does it change the intended meaning of the question? I find it really confusing that the question mixes both XML bombs and XSS. Can you pick one threat and ask about that one? "How do I defend against XML bombs?" is unrelated to "How do I defend against XSS?" – D.W. Feb 20 '11 at 3:18
let's make it simple, from your answer, only this sentence was worth it: If your goal is to defend against XML bomb attacks, a special DTD or schema is not the right defense – Phoenician-Eagle Feb 20 '11 at 13:01
up vote 1 down vote accepted

If your goal is to defend against XML bomb attacks, a special DTD or schema is not the right defense. The most robust defense is probably to place resource limits on your XML parser. For instance, run your XML parser in a separate process, with limits on how much memory and CPU time it can use; if it exceeds those limits, kill the parser and treat this as a failure to parse the XML document.

Another plausible defense against XML bomb attacks is to prevent XML documents from defining XML entities. For instance, disable inline definition of DTD schemas in your documents and prevent definition of external entities. This potentially comes at a loss of functionality, so it may not be an acceptable defense. (Alternatively, some XML parsers may give you a way to limit the expansion of XML entities, to prevent XML bombs.)

If your goal is to defend against XSS attacks, please rephrase the question. A special DTD or schema is not likely to be the right defense against XSS attacks, either, but you'll need to explain the problem more clearly before I can give better suggestions for dealing with XSS.

share|improve this answer

define some quality criteria, like check for expected type, check for the expected length, check for the expected range and etc

This is what the DTD does. But it's either valid or it is not - if you want a sliding scale you'll need to compare the XML against multiple DTDs (although since a XML doc can really only reference one DTD, the term 'XML templates' might be more appropriate, although the syntax would be the same).

share|improve this answer
Ok I will update my question – Phoenician-Eagle Jan 20 '11 at 15:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.