4 ms·

What? XML is super easy to parse. If you think XML is hard to parse, maybe you're trying to do it with a DOM interface, or wasting a bunch of time manually shuf

What? XML is super easy to parse. If you think XML is hard to parse, maybe you're trying to do it with a DOM interface, or wasting a bunch of time manually shuffling data around. The XML 1.0 spec is super short, once you ignore DTD stuff and things like entity references. In this case it's just a plist, which makes things even easier.

saagarjha 7y ago
And yet Apple has a handful of parsers which all parse it differently…
- klodolph 7y ago
  Can you elaborate on that? I know it's really in fashion to hate on XML here, I just want to understand what people's complaints are. Having written parsers for JSON, YAML, and XML at various points, I can tell you that XML was not much more complicated than JSON. It's got a good, clean spec and not too many rules.
  - saagarjha 7y ago
    I think Siguza’s blog post describes the background for this issue in a remarkably accessible way: https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/. You may also find libplist (a third-party plist parser)’s woes interesting: https://github.com/libimobiledevice/libplist/issues/83 https://github.com/libimobiledevice/libplist/issues/83
    - klodolph 7y ago
      The first article may be interesting or it may not be, it's four thousand words long and I don't know what I'm looking for. It sounds like there are some bugs in XML parsers. Well, people put bugs in simple code all the time. People also try to be clever and make parsers Very Fast, and people are also lazy and don't test simple edge cases. Mix these together and you get bugs. Then, some third-party plist parsing library written in C can segfault. I'm not surprised! Does that mean XML parsing is hard? No. It happened because it's easy to make a library written in C segfault, no matter how easy the problem you're solving is. C is like that. I can say that I have actually authored a different plist parsing library in C, and I don't remember running into a bunch of segfaults. What I do remember is that of the major plist variants, the XML variant was the easiest to work with. The text variant is more concise but you can't use an off-the-shelf XML parser. The binary format is poorly documented. Clear win for XML plists, in my book. I'm not going to take Apple's hit-or-miss software quality or bugs in some random third-party library as an indictment of XML.
      - saagarjha 7y ago
        Are you sure your parser parses it exactly how Apple’s does? Are you sure I couldn’t just fuzz it a bit and get it to crash?
        klodolph 7y ago
        Do you want me to explain my QA process to you? Or are you just trying to make a point? If you’re trying to make a point, just make your point, don’t waste my time by leading me around with questions.
        saagarjha 7y ago
        I am, actually: writing a parser that is bug-for-bug compatible with Apple is nontrivial, and you haven't given me anything so far that convinces me that you realize that complexity and have dealt with it in the way I am describing.
        klodolph 7y ago
        I asked because a conversation about whether I “realize that complexity” is exactly the kind of conversation I want to avoid. I’m not here to litigate how good a developer I am. The sense I’m getting—to be honest—is that you want to ask me questions until I “submit”. Maybe I’m off the mark! There are a lot of interesting directions that a conversation about parser correctness can go. You can discuss different goals, the idea of parsing to a spec versus matching the behavior of a reference implementation, fuzzing, attacks, stack overflow, and ergonomics like the quality of error messages. It’s an interesting subject.
        saagarjha 7y ago
        Note that this has nothing to do with how good a developer you are. I am specifically talking about your accuracy with parsing property lists as Apple does. You could have a perfect, XML spec compliant, stable parser and it would still not be relevant here because Apple does not use one themselves and third-party implementations which aim to be compatible must be bug-for-bug compatible.
  - deleted 7y ago
    [deleted]
overgard 7y ago
Just google "xml parser exploits". Parsing basic XML might not be hard, but when you get into the full spec and accompanying technologies the surface area of attack is huge.

saagarjha 7y ago

And yet Apple has a handful of parsers which all parse it differently…

klodolph 7y ago
Can you elaborate on that? I know it's really in fashion to hate on XML here, I just want to understand what people's complaints are. Having written parsers for JSON, YAML, and XML at various points, I can tell you that XML was not much more complicated than JSON. It's got a good, clean spec and not too many rules.
- saagarjha 7y ago
  I think Siguza’s blog post describes the background for this issue in a remarkably accessible way: https://siguza.github.io/psychicpaper/ https://siguza.github.io/psychicpaper/. You may also find libplist (a third-party plist parser)’s woes interesting: https://github.com/libimobiledevice/libplist/issues/83 https://github.com/libimobiledevice/libplist/issues/83
  - klodolph 7y ago
    The first article may be interesting or it may not be, it's four thousand words long and I don't know what I'm looking for. It sounds like there are some bugs in XML parsers. Well, people put bugs in simple code all the time. People also try to be clever and make parsers Very Fast, and people are also lazy and don't test simple edge cases. Mix these together and you get bugs. Then, some third-party plist parsing library written in C can segfault. I'm not surprised! Does that mean XML parsing is hard? No. It happened because it's easy to make a library written in C segfault, no matter how easy the problem you're solving is. C is like that. I can say that I have actually authored a different plist parsing library in C, and I don't remember running into a bunch of segfaults. What I do remember is that of the major plist variants, the XML variant was the easiest to work with. The text variant is more concise but you can't use an off-the-shelf XML parser. The binary format is poorly documented. Clear win for XML plists, in my book. I'm not going to take Apple's hit-or-miss software quality or bugs in some random third-party library as an indictment of XML.
    - saagarjha 7y ago
      Are you sure your parser parses it exactly how Apple’s does? Are you sure I couldn’t just fuzz it a bit and get it to crash?
      - klodolph 7y ago
        Do you want me to explain my QA process to you? Or are you just trying to make a point? If you’re trying to make a point, just make your point, don’t waste my time by leading me around with questions.
        saagarjha 7y ago
        I am, actually: writing a parser that is bug-for-bug compatible with Apple is nontrivial, and you haven't given me anything so far that convinces me that you realize that complexity and have dealt with it in the way I am describing.
        klodolph 7y ago
        I asked because a conversation about whether I “realize that complexity” is exactly the kind of conversation I want to avoid. I’m not here to litigate how good a developer I am. The sense I’m getting—to be honest—is that you want to ask me questions until I “submit”. Maybe I’m off the mark! There are a lot of interesting directions that a conversation about parser correctness can go. You can discuss different goals, the idea of parsing to a spec versus matching the behavior of a reference implementation, fuzzing, attacks, stack overflow, and ergonomics like the quality of error messages. It’s an interesting subject.
        saagarjha 7y ago
        Note that this has nothing to do with how good a developer you are. I am specifically talking about your accuracy with parsing property lists as Apple does. You could have a perfect, XML spec compliant, stable parser and it would still not be relevant here because Apple does not use one themselves and third-party implementations which aim to be compatible must be bug-for-bug compatible.
- deleted 7y ago
  [deleted]

overgard 7y ago

Just google "xml parser exploits". Parsing basic XML might not be hard, but when you get into the full spec and accompanying technologies the surface area of attack is huge.