[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50C9CE53.8020004@pre-sense.de>
Date: Thu, 13 Dec 2012 13:47:15 +0100
From: Timo Warns <warns@...-sense.de>
To: oss-security@...ts.openwall.com
Subject: Re: Robust XML validation
On 12.12.2012 18:11, Florian Weimer wrote:
> I'm working on guidelines for robust XML parsing and I noticed that
> there are some denial-of-service issues related to validation which do
> not seem widely documented (but were apparently known when SGML was
> specified).
I'm interested in such guidelines. Will they be public?
> I wonder if we should care about this in the sense that we should
> prepare fixes, or if it is sufficient to recommend to validate against
> trusted schemas/DTDs only. (I've found an implementation which gets
> right the things I tested so far, so efficient implementations aren't
> impossible.)
Validating against trusted schemas/DTDs would not be sufficient in my
opinion. For example, such validations are not effective against the
billion laughs attack (http://en.wikipedia.org/wiki/Billion_laughs).
Moreover, some projects deliberately decide against schema validation.
For example, when fixing CVE-2012-2665, LibreOffice developers have
decided against validating the manifest.xml against a schema or DTD.
If I understood correctly, the reason was that omitting validations
allows to open documents in a future format on a best-effort basis (as
an alternative to annoying the user with a "format not supported" message).
Regards, Timo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
