[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <50C8BAD3.60403@redhat.com>
Date: Wed, 12 Dec 2012 18:11:47 +0100
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Robust XML validation
I'm working on guidelines for robust XML parsing and I noticed that
there are some denial-of-service issues related to validation which do
not seem widely documented (but were apparently known when SGML was
specified).
I wonder if we should care about this in the sense that we should
prepare fixes, or if it is sufficient to recommend to validate against
trusted schemas/DTDs only. (I've found an implementation which gets
right the things I tested so far, so efficient implementations aren't
impossible.)
--
Florian Weimer / Red Hat Product Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
