This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

OWASP Periodic Table of Vulnerabilities - XML Injection

From OWASP
Revision as of 21:29, 22 July 2013 by James Landis (talk | contribs) (Created page with "Return to Periodic Table Working View == XML Injection == === Root Cause Summary === XML docume...")

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Return to Periodic Table Working View

XML Injection

Root Cause Summary

XML documents are generated by including dynamic data without proper encoding.

Browser / Standards Solution

None

Perimeter Solution

None

Generic Framework Solution

The framework should provide safe libraries for constructing and manipulating XML documents that automatically encode all dynamic data. The framework should disallow any direct access to raw XML.

Custom Framework Solution

None

Custom Code Solution

None

Discussion / Controversy

Cross-Site Scripting / HTML Injection is a special case of XML injection.

References

Testing for XML Injection (OWASP-DV-008)
XML Injection (WASC)
XML Injection (CWE)

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Periodic_Table_of_Vulnerabilities_-_XML_Injection&oldid=155875"