5 ms·

Of course it would be XML. XML is hell to parse. In fact I bet hell is trying to write XSLT for the rest of eternity.

plasma 6y ago
Looks like its actually just a plist/entitlements request in the app asking for access to do something and being allowed. I'm suspicious if this works in App Store apps though, from memory Apple checks what permissions the app is requesting as part of the submission process.
- kennywinker 6y ago
  Definitely wouldn't pass the first validation step when you upload a binary to app store connect
klodolph 6y ago
What? XML is super easy to parse. If you think XML is hard to parse, maybe you're trying to do it with a DOM interface, or wasting a bunch of time manually shuffling data around. The XML 1.0 spec is super short, once you ignore DTD stuff and things like entity references. In this case it's just a plist, which makes things even easier.
- saagarjha 6y ago
  And yet Apple has a handful of parsers which all parse it differently…
  - klodolph 6y ago
    Can you elaborate on that? I know it's really in fashion to hate on XML here, I just want to understand what people's complaints are. Having written parsers for JSON, YAML, and XML at various points, I can tell you that XML was not much more complicated than JSON. It's got a good, clean spec and not too many rules.
    - saagarjha 6y ago
      I think Siguza’s blog post describes the background for this issue in a remarkably accessible way: https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/. You may also find libplist (a third-party plist parser)’s woes interesting: https://github.com/libimobiledevice/libplist/issues/83 https://github.com/libimobiledevice/libplist/issues/83
      - klodolph 6y ago
        The first article may be interesting or it may not be, it's four thousand words long and I don't know what I'm looking for. It sounds like there are some bugs in XML parsers. Well, people put bugs in simple code all the time. People also try to be clever and make parsers Very Fast, and people are also lazy and don't test simple edge cases. Mix these together and you get bugs. Then, some third-party plist parsing library written in C can segfault. I'm not surprised! Does that mean XML parsing is hard? No. It happened because it's easy to make a library written in C segfault, no matter how easy the problem you're solving is. C is like that. I can say that I have actually authored a different plist parsing library in C, and I don't remember running into a bunch of segfaults. What I do remember is that of the major plist variants, the XML variant was the easiest to work with. The text variant is more concise but you can't use an off-the-shelf XML parser. The binary format is poorly documented. Clear win for XML plists, in my book. I'm not going to take Apple's hit-or-miss software quality or bugs in some random third-party library as an indictment of XML.
        saagarjha 6y ago
        Are you sure your parser parses it exactly how Apple’s does? Are you sure I couldn’t just fuzz it a bit and get it to crash?
        klodolph 6y ago
        Do you want me to explain my QA process to you? Or are you just trying to make a point? If you’re trying to make a point, just make your point, don’t waste my time by leading me around with questions.
- overgard 6y ago
  Just google "xml parser exploits". Parsing basic XML might not be hard, but when you get into the full spec and accompanying technologies the surface area of attack is huge.
silon42 6y ago
XSLT is not that bad... I'd take it over c++ templates and many other things any day.
eitland 6y ago
Compared to Javascript it is small and well defined AFAIK.
tannhaeuser 6y ago
TLDR: the gist of it is that one of Apple's XML parsers treat XML comments wrong and would advance a char pointer only two bytes when it should advance three bytes (eg. past "!--") such that this invalid XML comment passes <!---> whereas another parser correctly rejects the invalid XML comment. I don't see how this is a reason to hate on XML. A similar bug can surface in any property file parsing routine for a format having commenting syntax. It's amplified, though, by Apple (according to TFA) using four different XML parser implementations for parsing entitlement and other property (.plist) files, and the lack of testing/dilution of efforts that goes with a situation like this. I'll add that .plist files (or other simplistic property files for that matter) IMO had never a good reason to be XML. XML/SGML is really for delivery/authoring rich semi-structured text in a plain text editor (and is second-to-none for this use case). To me it seems that in this case using XML in the first place because it's already a widely (mis-)used format for general-purpose data serialization, and then not actually using an industrial-strength XML parser (such as libxml2, expat, or xerces) but coding your own ad-hoc XML parser instead is particular bad practice.
- saagarjha 6y ago
  Property lists have a binary format. The XML one is convenient because you can open it up in a text editor and modify it by hand.

Looks like its actually just a plist/entitlements request in the app asking for access to do something and being allowed. I'm suspicious if this works in App Store apps though, from memory Apple checks what permissions the app is requesting as part of the submission process.

kennywinker 6y ago
Definitely wouldn't pass the first validation step when you upload a binary to app store connect

klodolph 6y ago

What? XML is super easy to parse. If you think XML is hard to parse, maybe you're trying to do it with a DOM interface, or wasting a bunch of time manually shuffling data around. The XML 1.0 spec is super short, once you ignore DTD stuff and things like entity references. In this case it's just a plist, which makes things even easier.

saagarjha 6y ago
And yet Apple has a handful of parsers which all parse it differently…
- klodolph 6y ago
  Can you elaborate on that? I know it's really in fashion to hate on XML here, I just want to understand what people's complaints are. Having written parsers for JSON, YAML, and XML at various points, I can tell you that XML was not much more complicated than JSON. It's got a good, clean spec and not too many rules.
  - saagarjha 6y ago
    I think Siguza’s blog post describes the background for this issue in a remarkably accessible way: https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/. You may also find libplist (a third-party plist parser)’s woes interesting: https://github.com/libimobiledevice/libplist/issues/83 https://github.com/libimobiledevice/libplist/issues/83
    - klodolph 6y ago
      The first article may be interesting or it may not be, it's four thousand words long and I don't know what I'm looking for. It sounds like there are some bugs in XML parsers. Well, people put bugs in simple code all the time. People also try to be clever and make parsers Very Fast, and people are also lazy and don't test simple edge cases. Mix these together and you get bugs. Then, some third-party plist parsing library written in C can segfault. I'm not surprised! Does that mean XML parsing is hard? No. It happened because it's easy to make a library written in C segfault, no matter how easy the problem you're solving is. C is like that. I can say that I have actually authored a different plist parsing library in C, and I don't remember running into a bunch of segfaults. What I do remember is that of the major plist variants, the XML variant was the easiest to work with. The text variant is more concise but you can't use an off-the-shelf XML parser. The binary format is poorly documented. Clear win for XML plists, in my book. I'm not going to take Apple's hit-or-miss software quality or bugs in some random third-party library as an indictment of XML.
      - saagarjha 6y ago
        Are you sure your parser parses it exactly how Apple’s does? Are you sure I couldn’t just fuzz it a bit and get it to crash?
        klodolph 6y ago
        Do you want me to explain my QA process to you? Or are you just trying to make a point? If you’re trying to make a point, just make your point, don’t waste my time by leading me around with questions.
overgard 6y ago
Just google "xml parser exploits". Parsing basic XML might not be hard, but when you get into the full spec and accompanying technologies the surface area of attack is huge.

silon42 6y ago

XSLT is not that bad... I'd take it over c++ templates and many other things any day.

eitland 6y ago

Compared to Javascript it is small and well defined AFAIK.

tannhaeuser 6y ago

TLDR: the gist of it is that one of Apple's XML parsers treat XML comments wrong and would advance a char pointer only two bytes when it should advance three bytes (eg. past "!--") such that this invalid XML comment passes <!---> whereas another parser correctly rejects the invalid XML comment. I don't see how this is a reason to hate on XML. A similar bug can surface in any property file parsing routine for a format having commenting syntax. It's amplified, though, by Apple (according to TFA) using four different XML parser implementations for parsing entitlement and other property (.plist) files, and the lack of testing/dilution of efforts that goes with a situation like this. I'll add that .plist files (or other simplistic property files for that matter) IMO had never a good reason to be XML. XML/SGML is really for delivery/authoring rich semi-structured text in a plain text editor (and is second-to-none for this use case). To me it seems that in this case using XML in the first place because it's already a widely (mis-)used format for general-purpose data serialization, and then not actually using an industrial-strength XML parser (such as libxml2, expat, or xerces) but coding your own ad-hoc XML parser instead is particular bad practice.

saagarjha 6y ago
Property lists have a binary format. The XML one is convenient because you can open it up in a text editor and modify it by hand.