Reviewing Web Services - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:54:19Z

Added navigation to facilitate sequential reading online

KirstenS: /* Reviewing Webservices and XML Payloads */

2009-05-22T12:58:54Z

‎Reviewing Webservices and XML Payloads

Mkyle at 16:23, 1 April 2009

2009-04-01T16:23:06Z

KirstenS: /* Infinite Occurrences of an Element or Attribute */

2009-01-29T01:38:50Z

‎Infinite Occurrences of an Element or Attribute

KirstenS: /* Weak namespace, Global elements, the element & SAX XML processors */

2009-01-29T01:38:37Z

‎Weak namespace, Global elements, the <any> element & SAX XML processors

KirstenS: /* XML Schema : Input validation */

2009-01-29T01:34:13Z

‎XML Schema : Input validation

KirstenS at 21:30, 15 January 2009

2009-01-15T21:30:22Z

KirstenS: /* Reviewing Webservices and XML payloads */

2009-01-15T21:28:45Z

‎Reviewing Webservices and XML payloads

KirstenS: Webservices moved to Reviewing Web Services

2009-01-15T21:19:56Z

Webservices moved to Reviewing Web Services

EoinKeary: /* Weak namespace, Global elements, the element & SAX XML processors */

2008-09-30T11:54:06Z

‎Weak namespace, Global elements, the <any> element & SAX XML processors

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
@@ Line 54: / Line 59: @@
 A schema that does not define restrictive element namespaces permits arbitrary elements to be included in a valid document, which may not be expected by the application. This may give rise to attacks, such as XML Injection, which consist of including tags which are not expected by the application.
 [[Category:OWASP Code Review Project]]

@@ Line 3: / Line 3: @@
 ==Reviewing Webservices and XML Payloads==
-When reviewing webservices, one should focus firstly on the generic security controls related to any application. Web services also have some unique controls should be looked at.
+When reviewing webservices, one should focus firstly on the generic security controls related to any application. Webservices also have some unique controls should be looked at.
 ===XML Schema : Input validation===

@@ Line 24: / Line 24: @@
 * '''skip''' There is no attempt to validate the XML.
-  processContents=skip\lax\skip
+  processContents=strict\lax\skip
 ===Infinite Occurrences of an Element or Attribute===

@@ Line 27: / Line 27: @@
 ===Infinite Occurrences of an Element or Attribute===
 The unbounded value can be used on an XML schema to specify the there is no maximum occurrence expected for a specific element.
   maxOccurs= positive-Integer|unbounded
 Given that any number of elements can be supplied for an unbounded element, it is subject to attack via supplying the web service with vast amounts of elements, and hence a resource exhaustion issue.
 ===Weak namespace, Global elements, the <any> element & SAX XML processors===

← Older revision		Revision as of 01:38, 29 January 2009
Line 52:		Line 52:

	A namespace of ##any in the <any> element means the schema allows elements beyond what is explicitly defined in the schema, thereby reducing control on expected elements for a given request.		A namespace of ##any in the <any> element means the schema allows elements beyond what is explicitly defined in the schema, thereby reducing control on expected elements for a given request.
−

	<xs:any namespace='##any' />		<xs:any namespace='##any' />

@@ Line 8: / Line 8: @@
 Schemas are used to ensure that the XML payload received is within defined and expected limits. They can be specific to a list of known good values or simply define length and type. Some XML applications do not have a schema implemented, which may mean input validation is performed downstream or even not at all!!
-''Keywords'':
+''Keywords''
   '''Namespace''': : An XML namespace is a collection of XML elements and attributes identified by an Internationalised Resource Identifier (RI).

@@ Line 1: / Line 1: @@
-===Reviewing Webservices and XML payloads===
+==Reviewing Webservices and XML Payloads==
-When reviewing webservices one should focus firstly on the generic security controls related to any application. Webservices also have some uniques controls should be looked at.
+When reviewing webservices, one should focus firstly on the generic security controls related to any application. Web services also have some unique controls should be looked at.
-====XMLL Schema : Input validation====
+''Keywords'':
-Schemas are used to ensure that the XML payload received is within defined and expected limits. They can be specific to a list of known good values or simply define lenght and type. Some XML applications do not have a schema implemented which may mean input validation is perfromed downstream ot even not at all!!
+ '''Namespace''': : An XML namespace is a collection of XML elements and attributes identified by an Internationalised Resource Identifier (RI).
-''Keywords'':
+To distinguish between such different definitions with the same name, an XML Schema allows the concept of namespaces -  think Java packages :)
-The schema can specify a finite amount of parameters, the expected parameters in the XML payload alongside the expected types and values of the payload data:
+The schema can specify a finite amount of parameters, the expected parameters in the XML payload alongside the expected types and values of the payload data.
-The ProcessContents attribute indicates how XML from other namespaces should be validated.
+The ProcessContents attribute indicates how XML from other namespaces should be validated. When the processContents attribute is set to  '''lax''' or '''skip''', input validation is not performed for wildcard attributes and parameters.
 The value for this attribute may be
 * '''strict''': There must be a declaration associated with the namespace and validate the XML.
-* '''lax''' There should attempt to validate the XML against its schema.
+* '''lax''' There should be an attempt to validate the XML against its schema.
 * '''skip''' There is no attempt to validate the XML.
   processContents=skip\lax\skip
-====Infinite occurances of an element or attribute====
+===Infinite Occurrences of an Element or Attribute===
-The unbounded value can be used  un an XML schema to specify the there is no maximum occurance expected for a specific element.
+The unbounded value can be used on an XML schema to specify the there is no maximum occurrence expected for a specific element.
   maxOccurs= positive-Integer|unbounded
-Given that any number of elements can be supplied for an unbounded element it is subject to attack via supplying the web service with vast amounts of elements and hence a resource exhaustion issue.
+Given that any number of elements can be supplied for an unbounded element, it is subject to attack via supplying the web service with vast amounts of elements, and hence a resource exhaustion issue.
-====Weak namespace, Global elements, the <any> element & SAX XML processors====
+===Weak namespace, Global elements, the <any> element & SAX XML processors===
-The <any> element can be used to make extensible documents, allowing  documents to contain additional elements which are not declared in the main schema.
+The <any> element can be used to make extensible documents, allowing documents to contain additional elements which are not declared in the main schema. The idea that an application can accept any number of parameters may be cause for alarm. This may lead to denial of availability or even in the case of a SAX XML parser legitimate values may be overwritten.
   <xs:element name="cloud">
@@ Line 47: / Line 46: @@
   </xs:element>
-The <any> element here premits additional parameters to be added in an arbitary manner.
+The <any> element here permits additional parameters to be added in an arbitary manner.
   <xs:any namespace='##any' />
-A schema that does not define restrictive element namespaces permits arbitrary elements to be included in a valid document which may not be expected by the application.
+A schema that does not define restrictive element namespaces permits arbitrary elements to be included in a valid document, which may not be expected by the application. This may give rise to attacks, such as XML Injection, which consist of including tags which are not expected by the application.

← Older revision	Revision as of 21:19, 15 January 2009
(No difference)

@@ Line 42: / Line 42: @@
        <xs:element name="process" type="xs:string"/>
        <xs:element name="lastcall" type="xs:string"/>
-       <xs:any minOccurs="0"/>
+       '''<xs:any minOccurs="0"/>'''
      </xs:sequence>
    </xs:complexType>
   </xs:element>
-The <any> element here premits additional parameters to be added in an arbitary manner. In the case of
+The <any> element here premits additional parameters to be added in an arbitary manner.