What can one define as quality criteria for an XML Schema?

Question

One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality criteria) are to check for expected type, check for the expected length, check for the expected range and etc...

XML Bombs typically exploits the XML parser in processing the XML DTD or XML Schema. Therefore, I am wondering whether some would be able to help me defining some "quality" criteria for checking that the XML Schema are not vulnerable to, FOR INSTANCE XML Bombs... as similar to the way I mentioned for Input Validation.

Is there any, or what are the best practices in creating XML Schema in order, for instance, to avoid endless loops, or ...

In case there are already some XML Schema security validation tools or APIs as there are for Input Validation against XSS..., also I am interested.

Answer 1

If your goal is to defend against XML bomb attacks, a special DTD or schema is not the right defense. The most robust defense is probably to place resource limits on your XML parser. For instance, run your XML parser in a separate process, with limits on how much memory and CPU time it can use; if it exceeds those limits, kill the parser and treat this as a failure to parse the XML document.

Another plausible defense against XML bomb attacks is to prevent XML documents from defining XML entities. For instance, disable inline definition of DTD schemas in your documents and prevent definition of external entities. This potentially comes at a loss of functionality, so it may not be an acceptable defense. (Alternatively, some XML parsers may give you a way to limit the expansion of XML entities, to prevent XML bombs.)

If your goal is to defend against XSS attacks, please rephrase the question. A special DTD or schema is not likely to be the right defense against XSS attacks, either, but you'll need to explain the problem more clearly before I can give better suggestions for dealing with XSS.

Answer 2

define some quality criteria, like check for expected type, check for the expected length, check for the expected range and etc

This is what the DTD does. But it's either valid or it is not - if you want a sliding scale you'll need to compare the XML against multiple DTDs (although since a XML doc can really only reference one DTD, the term 'XML templates' might be more appropriate, although the syntax would be the same).