W3C home > Mailing lists > Public > www-tag@w3.org > October 2002

Re: Possible issue: XXE (Xml eXternal Entity) attack

From: Miles Sabin <miles@milessabin.com>
Date: Wed, 30 Oct 2002 10:23:12 +0000
To: www-tag@w3.org
Message-Id: <200210301023.12555.miles@milessabin.com>

Rick Jelliffe wrote,
> It strikes me that this puts the cart before the horse.  The answer
> is not to ban external entities, it is to allow access control lists
> as part of entity managers or URL resolvers.

Sure, but isn't that tantamount to agreeing with,

  Suggested fix:
   Most XML parsers allow their user to explicitly specify external
   entity handler. In case of untrusted XML input it is best to prohibit
   all external general entities.

because your ACL will effectively be whitelisting your *trusted* 
sources.

Cheers,


Miles
Received on Wednesday, 30 October 2002 05:23:45 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Thursday, 26 April 2012 12:47:12 GMT