3 ms·
> XML is mature and supported in all languages with code generation its more or less transparent to the dev. No, XML is still not mature. They still need to fi
by throwaway7356 19d ago
> XML is mature and supported in all languages with code generation its more or less transparent to the dev.
No, XML is still not mature. They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. It basically doesn't handle untrusted input well, like SQL built from strings without parameter bindings.
I hope this is reasonable and doesn't use XML Security or similar extensions that add a whole stack of other security issues on top that everyone reimplements when adding SAML support.
- xienze 19d ago> They still need to fix the security issues everyone reimplements every time such as local file disclosure via DTDs, exploding documents due to entity expansion and so on. Who is doing this reimplementation? You're supposed to be using mature, battle-tested libraries for parsing these formats. Writing your own parser for just about any format is a fool's errand when good implementations that have already addressed these issues exist. Even a simple format like JSON is not immune to performance, safety, and correctness pitfalls.
- throwaway7356 19d agoMany libraries still have unsafe defaults. They come from the XML-age where security concerns were minor (SQL injection was still new to most!) Using XML in a safe way requires you to study what is wrong with XML first. That is not what many people do.
- apelapan 19d agoXML is not perfect, but it is mature. It has been the same for a very long time, all the warts and gotchas are well known. You need to be careful about the same things in 2026 as you did back in 2006.