• To: "Ronald Bourret" <rpbourret@r...>,<xml-dev@l...>
• Subject: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• From: "Rob Lugt" <roblugt@e...>
• Date: Mon, 10 Jun 2002 09:52:36 +0100
• References: <000a01c20ecc$90ebb980$887ba8c0@mitchum> <200206081044.42559.miles@m...> <3D0458DA.B5512DC9@r...>

Ronald Bourret wrote

> Worse yet, this isn't limited to validation. A parser is free to read an
> external DTD (to get attribute defaults and entity values) even when it
> isn't validating. I haven't looked at any of the parsers I've used
> closely enough, but it would surprise me if any had a way to turn this
> completely off.
>

Hi Ron, prepare to be pleasantly surprised.  There is a standard feature in
SAX called "http://xml.org/sax/features/external-parameter-entities", which
prevents the parser from reading any external entities - including the
external DTD subset.

Not all SAX parsers support this feature, but many do (ours included).

Regards
~Rob

--
Rob Lugt
ElCel Technology
http://www.elcel.com/

• Follow-Ups:
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>

• References:
  • RE: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Bill de hÓra <dehora@e...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Miles Sabin <miles@m...>
  • Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
    • From: Ronald Bourret <rpbourret@r...>

• Prev by Date: How to find out the name of the tag where my xmldocument did not validate
• Next by Date: Re: Evangelizing RNG
• Previous by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Next by thread: Re: Malicious documents? (WAS: Interesting mailing list & a rare broadside)
• Index(es):
  • Date
  • Thread