Re: Robust XML validation

[Timo Warns <warns () pre-sense de>]

On 12.12.2012 18:11, Florian Weimer wrote:
> I'm working on guidelines for robust XML parsing and I noticed that 
> there are some denial-of-service issues related to validation which do 
> not seem widely documented (but were apparently known when SGML was 
> specified).

I'm interested in such guidelines. Will they be public?

> I wonder if we should care about this in the sense that we should 
> prepare fixes, or if it is sufficient to recommend to validate against 
> trusted schemas/DTDs only.  (I've found an implementation which gets 
> right the things I tested so far, so efficient implementations aren't 
> impossible.)

Validating against trusted schemas/DTDs would not be sufficient in my
opinion. For example, such validations are not effective against the
billion laughs attack (http://en.wikipedia.org/wiki/Billion_laughs).

Moreover, some projects deliberately decide against schema validation.
For example, when fixing CVE-2012-2665, LibreOffice developers have
decided against validating the manifest.xml against a schema or DTD.
If I understood correctly, the reason was that omitting validations
allows to open documents in a future format on a best-effort basis (as
an alternative to annoying the user with a "format not supported" message).

Regards, Timo