3 ms·
Yeah, that's why I consider it to be a breeding ground for vulnerabilities. People will probably just assume the XML serializer can handle any strings in their
by slaymaker1907 4y ago
Yeah, that's why I consider it to be a breeding ground for vulnerabilities. People will probably just assume the XML serializer can handle any strings in their language of choice and not handle those edge cases. What I ended up doing for my use case was to encode nulls as " " but within a CDATA section so it was interpreted literally (choosing ambiguity over omission). The best way would probably be to have some sort of spell <null /> element, but there isn't such a thing within the standard. There asi:nil, but that is really indicating something else.
- taeric 4y agoBut what is the vulnerability? And what is a null character doing in a text document? If you are just worried about data loss, having null allowed in text segments is already begging for failure, as C programs will almost certainly get them wrong. If you are transferring binary, base64 or similar will already cover you. And again, if this is a strike on xml, how do you represent NaN in a JSON document? Do what DynamoDB does and wrap all numbers in quotes?