• To: xml-dev@l...
• Subject: Re: XInclude: security risk 1
• From: "Simon St.Laurent" <simonstl@s...>
• Date: Sat, 26 Oct 2002 14:03:22 -0400
• In-reply-to: <p04330100b9e080b82819@[192.168.254.4]>

At 01:47 PM 10/26/2002 -0400, Elliotte Rusty Harold wrote:
>However, I suspect it's at least bad enough that browser vendors and other 
>XInclude users should be made aware of the issues, and perhaps not 
>XInclude by default; or perhaps it would be enough just not to fallback. 
>Or perhaps not make the post-inclusion DOM available through scripting. Or 
>limit the URLs included to ones from the same host as the base page came 
>from. Thoughts?

It reminds me a bit of the issues that David Megginson raised back at XTech 
2000:
http://www.xml.com/pub/a/2000/02/xtech/megginson.html

I can't find David's original slides, but it more or less covered the risks 
created by wide-open URI processing in a variety of different contexts.  It 
was prior to XInclude, but pretty interesting stuff.  Those tools don't 
include a fallback for sending messages back, though!



Simon St.Laurent
"Every day in every way I'm getting better and better." - Emile Coue

• Follow-Ups:
  • Re: XInclude: security risk 1
    • From: Miles Sabin <miles@m...>
  • Re: XInclude: security risk 1
    • From: David Megginson <david@m...>

• References:
  • XInclude: security risk 1
    • From: Elliotte Rusty Harold <elharo@m...>

• Prev by Date: XInclude: security risk 1
• Next by Date: Re: XInclude: security risk 1
• Previous by thread: XInclude: security risk 1
• Next by thread: Re: XInclude: security risk 1
• Index(es):
  • Date
  • Thread