Hot answers tagged xml
12
I'm a PHP 'newbie' if you may call me one. But having analyzed XML and XSLT libraries in the past for security vulnerabilities, and having recently done work on an application that uses quite a bit of XML, here's what I could think of:
If it is possible to pass in a XSL transformation that causes execution of privileged code, you might have to find some ...
7
The XML syntax allows for automatic inclusion of other files, which can be on the same system, or even elsewhere (through a URL). See for instance this documentation. The attack would be conceptually a case where the attacker can add an "external entity reference" in a piece of XML which will be interpreted as XML by a machine (e.g. a Web server), with the ...
5
According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF),
The W3C XML Encryption specification today marks the de-facto standard
for data encryption in complex distributed applications. The use of
XML as core data syntax, e.g. for major business, e-commerce,
financial, healthcare, governmental and military applications, has
...
5
Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to).
Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...
4
Secure XML processing using DTD's and XSD's is tricky.
You should ensure that the correct dtd's and xsd's are referenced for your use case before processing the xml file with a parser (and that mixed xml content is not added such as alternate xmlns, local dtd definitions in the xml, Entity expansions etc).
As I heard on an OWASP podcast OWASP Podcast ...
4
The primary risk in not syntax checking your XML is invalid parsing.
If the software reading the XML can't handle invalid input, it might crash, do something unexpected, spontaneously explode (probably not), etc. Those situations can lead to security flaws - but if the software is brittle enough not to be able to handle invalid XML, it will very likely ...
3
You cannot really test an ASN.1 parser for correction, because it is a complex piece of software and we do not know how to prove that a given piece of software is correct. What you can do is rely on a library with good repute. You might want to have a look at this question. Alternatively, reimplement it yourself; this is not very hard if you stick to a ...
2
Well, the first thing that comes to mind is that if you remove an external endpoint of an API that an application relies on, then yeah, it would probably break. :)
More specifically it really depends on the application in question. If it only works over XMLRPC and it needs to connect from a different machine, then yes it will break if you remove the access. ...
2
Yes, of course.
It's the same as a code review, or a deployment inspection.
During CR, I would expect configuration files to be part of the code base that is examined; and during a deployment inspection, all configurations you can get your hands on should be opened up and examined.
That also answers no.2 - explain to the manager that its part of the ...
2
No idea how Microsoft internal tools interacts with the service. You'd have to ask them, and they won't tell you. A friend used to work in MSIT building said tools, and even he wouldn't tell me.
However, there should be a sample in the Windows SDK that gets installed here (source: ...
1
Document types (or DOCTYPE) is a declarative and semantical element which is part of the W3C specification regarding markup languages documents (such as XHTML).
Their presence (or non-presence) within a markup document does not influence a whatever security aspect when they are being rendered and processed by a web browser.
If you are writing an XHTML 1.1 ...
1
Yes -- sort of. (IMO) It should be up to that team to define minimum requirements; e.g. which encryption methods to use, but they shouldn't lock down the likes of exposed methods. That should belong to developer security architects. Unless of course the IT Security Team has developers on it.
EDIT: It is a little much to expect a firewall administrator ...
Only top voted, non community-wiki answers of a minimum length are eligible
