XML (Extensible Markup Language) is a set of rules for encoding documents in both human-readable and machine-readable form. It is defined in the XML 1.0 Specification produced by the W3C, and several other related specifications, all gratis open standards.
10
votes
1answer
331 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
7
votes
3answers
383 views
If an XML document is not validated as “Well Formed” or checked against a schema, what are the risks?
When processing an XML document in my application, what are the risks? E.g. if it is not "Well Formed" or is not checked against a schema.
7
votes
3answers
171 views
How do I test and secure ASN.1 Parsers?
As far as I can tell, .NET doesn't have an ASN.1 parser for reading or writing data built in the framework. This means that any code that creates or verifies ASN.1 data is using a 3rd party library ...
6
votes
2answers
283 views
Does anyone use XML Encryption?
The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard.
Does anyone use this XML encryption format? Are there any significant deployed systems ...
4
votes
1answer
249 views
How can XML Injection be exploited , need example?
So I found this explanation for a vulnerability on some cms :
The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML
external entity attacks which can be used to Scan behind ...
2
votes
2answers
163 views
Is WCF or Java Metro security configuration in-scope for your security department; should it be?
Windows Communication Foundation (WCF) is a set of technologies that expose server-side executable code and data over the Internet.
Given the port sharing abilities of IIS, or even that a web ...
1
vote
1answer
181 views
How does a developer interact with Microsoft Certificate *Web Services*
Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
1
vote
1answer
114 views
Does an exposed XMLRPC API in a web application pose a threat?
I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
0
votes
1answer
140 views
Does using many XML parsers (XDocument, XMLDocument) from the public Internet increase attack surface area?
I am coding an anonymous WCF service that allows others to post XML into it.
Does using different kinds of XML parsers XDocument, XMLDocument, or even 3rd party parsers increase the attack surface ...
0
votes
1answer
99 views
How does DOCTYPE selection affect security of my AJAX app?
I'm considering using modern techniques to protect my Javascript code and am studying how the DOCTYPE element selection may impact that. Specifically, the linked question used IFrames which are not ...
0
votes
0answers
102 views
How to implement url encryption on .xsl page using OWASP ESAPI? [closed]
I am implementing url encryption on an .xsl page.
A Java servlet instantiates the following:
String myparameter = ESAPI.httpUtilities().encryptQueryString(request.getQueryString());
My xsl page ...
0
votes
1answer
414 views
How do I change the certificate of a Shibboleth service provider?
How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed ...
-1
votes
2answers
358 views
What can one define as quality criteria for an XML Schema?
One of the usage of Input validation, is to be protect against XSS. In case one would need to define best practice for the functions validating the input, then some (which I am calling quality ...
-2
votes
2answers
270 views
Is it secure to use XML to build iPhone application? [closed]
I know PHP/MYSQL but i don't know much about iPhone development and as such I found someone to help me. He is telling me that he can make my app, which will be a basic note taking service that will ...
