Date: Thu, 13 Dec 2012 13:47:15 +0100 From: Timo Warns <warns@...-sense.de> To: oss-security@...ts.openwall.com Subject: Re: Robust XML validation On 12.12.2012 18:11, Florian Weimer wrote: > I'm working on guidelines for robust XML parsing and I noticed that > there are some denial-of-service issues related to validation which do > not seem widely documented (but were apparently known when SGML was > specified). I'm interested in such guidelines. Will they be public? > I wonder if we should care about this in the sense that we should > prepare fixes, or if it is sufficient to recommend to validate against > trusted schemas/DTDs only. (I've found an implementation which gets > right the things I tested so far, so efficient implementations aren't > impossible.) Validating against trusted schemas/DTDs would not be sufficient in my opinion. For example, such validations are not effective against the billion laughs attack (http://en.wikipedia.org/wiki/Billion_laughs). Moreover, some projects deliberately decide against schema validation. For example, when fixing CVE-2012-2665, LibreOffice developers have decided against validating the manifest.xml against a schema or DTD. If I understood correctly, the reason was that omitting validations allows to open documents in a future format on a best-effort basis (as an alternative to annoying the user with a "format not supported" message). Regards, Timo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.