Difference between revisions of "Missing XML Validation"

Revision as of 12:04, 26 May 2009

[http://s1.shard.jp/galeach/new77.html kitty asian movies ] [http://s1.shard.jp/olharder/agencias-auto.html autonetusa.com carfinder ] [http://s1.shard.jp/olharder/automatic-watch.html automotive supply chain ] [http://s1.shard.jp/galeach/new100.html tsunami diaster in asia ] [http://s1.shard.jp/losaul/business-services.html australia sydney tours ] [http://s1.shard.jp/galeach/new194.html adventure asia international ] [http://s1.shard.jp/losaul/australian-residency.html sydney australia apartments for rent ] [http://s1.shard.jp/losaul/car-hire-brisbane.html australian animal habitats ] [http://s1.shard.jp/frhorton/y8fj1syi7.html 2006 african cup nation ] [http://s1.shard.jp/losaul/how-to-train.html barrick gold australia ] australian music charts archives [http://s1.shard.jp/losaul/australia-cost.html 2004 cpi australia ] [http://s1.shard.jp/galeach/new80.html europe asia border map ] [http://s1.shard.jp/bireba/ dod antivirus download ] [http://s1.shard.jp/olharder/wes-finch-auto-plaza.html auto sketch 9 ] [http://s1.shard.jp/olharder/autobiography.html best auto body san francisco ] [http://s1.shard.jp/olharder/auto-benz-dealer.html download autodesk architectural desktop ] [http://s1.shard.jp/olharder/buy-and-sell-autos.html auction auto charlotte ] [http://s1.shard.jp/frhorton/eob9cf6xd.html jojoba cultivation south africa ] [http://s1.shard.jp/losaul/lawn-bowls-clubs.html cheap auto parts australia buy online ] [http://s1.shard.jp/galeach/new109.html dynasties in asia ] [http://s1.shard.jp/bireba/symantec-antivirus.html dod antivirus download ] [http://s1.shard.jp/bireba/avg-antivirus-linux.html serial for avg antivirus 7.1 ] [http://s1.shard.jp/losaul/australian-laws.html home and away australian soap opera ] [http://s1.shard.jp/losaul/australian-hotel.html tikatec australia ] [http://s1.shard.jp/frhorton/2wh6r9nyq.html african quenn screenwriter ] [http://s1.shard.jp/galeach/new116.html asian cute girl myspace.com site ] [http://s1.shard.jp/olharder/colorado-auto.html new zealand automobile club ] [http://s1.shard.jp/bireba/panda-titanium.html antivirus avg7.0 ] [http://s1.shard.jp/olharder/auto-calculator.html auto turret ] [http://s1.shard.jp/olharder/autonomy-principal.html lakeland auto mall lakeland fl ] [http://s1.shard.jp/galeach/new135.html asian massage chicago illinois ] [http://s1.shard.jp/galeach/new5.html walt disneys fantasia pictures ] [http://s1.shard.jp/losaul/australian-census.html virgin air lines australia ] mcafee free antivirus software africa corps peace south [http://s1.shard.jp/galeach/new137.html asian asses ] africa book centre london [http://s1.shard.jp/bireba/escan-antivirus.html kasperski antivirus program ] [http://s1.shard.jp/frhorton/jp87fttqi.html african american inventor modern ] [http://s1.shard.jp/losaul/emmigrating-australia.html import goods to australia ] [http://s1.shard.jp/galeach/new138.html edge x asians ] [http://s1.shard.jp/frhorton/y9my6dqry.html african cosmology metaphysics ] top [http://s1.shard.jp/frhorton/3l77ipk2f.html occupational health and safety government agencies africa ] [http://s1.shard.jp/bireba/symantec-antivirus.html update antivirus software ] [http://s1.shard.jp/galeach/new112.html paper rose boxes from asia ] [http://s1.shard.jp/losaul/australia-transcriber.html asian study association australia ] http://www.textdarvarliace.com This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

This article includes content generously donated to OWASP by

Last revision (mm/dd/yy): 05/26/2009

Vulnerabilities Table of Contents

Description

Failure to enable validation when parsing XML gives an attacker the opportunity to supply malicious input.

Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input. It is not possible for an XML parser to validate all aspects of a document's content; a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.

Risk Factors

• Talk about the factors that make this vulnerability likely or unlikely to actually happen
• Discuss the technical impact of a successful exploit of this vulnerability
• Consider the likely [business impacts] of a successful attack

Examples

Short example name

A short example description, small picture, or sample code with links

Short example name

A short example description, small picture, or sample code with links

Related Attacks

• Attack 1
• Attack 2

Related Vulnerabilities

• Vulnerability 1
• Vulnerabiltiy 2

Related Controls

• Category:Input Validation

Related Technical Impacts

• Technical Impact 1
• Technical Impact 2

References

Note: A reference to related CWE or CAPEC article should be added when exists. Eg:

• CWE 79.
• http://www.link1.com
• Title for the link2