11–20 of 22 posts
Fascinating reading: > The majority of developers are unacquainted with features such as processing instructions and entity expansions that XML inherited from SGML. At best they know about from experience with HTML but they are not aware that a document type definition (DTD) can generate an HTTP request or load a file from the file system. I was one of them!
I still one of them!
This reminds me of Zip Bomb [1], aka, Zip of Death (ZOD) [2]
Earlier quoted context omitted.
Do you mean that it is, in fact, a mistake to use defusedxml instead of lxml in Python?
From the author themselves, 6 years ago: > defusedxml.lxml is no longer needed and supported. Nowadays libxml2 has builtin limitation for entity expansion. https://github.com/tiran/defusedxml/issues/25#issuecomment-4...
Ah those were the days
Fascinating reading: > The majority of developers are unacquainted with features such as processing instructions and entity expansions that XML inherited from SGML. At best they know about from experience with HTML but they are not aware that a document type definition (DTD) can generate an HTTP request or load a file from the file system. I was one of them!
So in practise you probably dont have to worry too much as long as you dont enable optional features in your xml library. (There are probably exceptions)
Fascinating reading: > The majority of developers are unacquainted with features such as processing instructions and entity expansions that XML inherited from SGML. At best they know about from experience with HTML but they are not aware that a document type definition (DTD) can generate an HTTP request or load a file from the file system. I was one of them!
Developers are even less aware that SGML has (and always had) quantities in the SGML declaration, allowing among other things to restrict the nesting/expansion level of entities (and hence to counter EE attacks without resorting to heuristics). Regarding DOCTYPE and DTDs, browsers at best made use of those to switch into or out of "quirks mode", on seeing special hardcoded public identifiers but ignored any declarati…
Not when processing XML mime types. In modern browsers that mostly means SVG files, but i think XHTML is still possible.
(Modern) HTML is neither SGML nor XML, so it doesn't follow the rules of either.
Back in one day… I saw my first xml/html exploit by another script kiddie on AOL. I was like wtf and began trying to crash my own account. A simple quote mismatch with a bunch of ampersands eventually did it (something 1000 nested ampersand escape sequences). Anyways was pretty proud of what I built, so I found a guy smarting off in an AOL chat and decided to bomb him. And yeah, he was a moderator for AOL… so at 12 y…
Does `lxml` match `etree` in the table?
expat, the xml library underlying python's etree and other xml interfaces, has either mitigated these standard xml vulnerabilities or disables the dangerous features by default.
The python docs are still a bit confusing there, but if you look at this table: https://docs.python.org/3/library/xml.html#xml-vulnerabiliti...
While this table has a lot of "Vulnerable" in it, they all come with footnotes saying that up-to-date versions of expat are not vulnerable.
So... if you want to have more secure xml parsing in python, make sure you use an up-to-date expat library or one where security fixes have been backported. You don't need anything else.
Earlier quoted context omitted.
Developers are even less aware that SGML has (and always had) quantities in the SGML declaration, allowing among other things to restrict the nesting/expansion level of entities (and hence to counter EE attacks without resorting to heuristics). Regarding DOCTYPE and DTDs, browsers at best made use of those to switch into or out of "quirks mode", on seeing special hardcoded public identifiers but ignored any declarati…
> Regarding DOCTYPE and DTDs, browsers at best made use of those to switch into or out of "quirks mode", on seeing special hardcoded public identifiers but ignored any declarations. Not when processing XML mime types. In modern browsers that mostly means SVG files, but i think XHTML is still possible. (Modern) HTML is neither SGML nor XML, so it doesn't follow the rules of either.
Where HTML does violate SGML was when CSS and JS were introduced already, to prevent legacy browsers displaying inline CSS or JS as content. The original sin being to be place these into content rather than attributes or strictly into external resources in the first place.
Regarding SVG and XHTML, note browsers basically ignore most DTD declarations in those.
[1]: XML Prague 2017 proceedings pp. 101 ff. available at https://archive.xmlprague.cz/2017/files/xmlprague-2017-proce...>
[2]: https://sgmljs.net/blog.html>
[3]: https://lobste.rs/s/o9khjn/first_html_lsp_reports_syntax_err...>