3 ms·

So by default many XML libraries essentially allow remote code execution? How in the world is that ok? How is that the standard?

by eieio 13y ago

yen223 13y ago
Not just XML, JSON parsers are notoriously vulnerable as well.
- euank 13y ago
  Citation needed. There have been many vulnerabilities in YAML parsers for ruby because they let you encode actual objects / code. JSON, despite being "Javascript object notation", can't actually encode full code/objects. You only have a few datatypes: (off the top of my head) bools, strings, numbers, arrays, key/value dicts. None of these are dangerous or difficult to parse. What you might be thinking about is the recent Ruby on Rails vulnerability which was caused by transforming JSON into YAML and then parsing the YAML. It would be more accurate to say the YAML parser was vulnerable. Your claim that "JSON parsers are notoriously vulnerable" implies that this is a common occurrence as well, not just a single incidence. I personally don't see it as likely because JSON has pretty much no features compared to xml; the surface area is tiny.
  - psuter 13y ago
    Not exactly remote execution, but the parsing and construction of key/value dictionaries can be and has been exploited [1]. [1] http://arstechnica.com/business/2011/12/huge-portions-of-web-vulnerable-to-hashing-denial-of-service-attack/ http://arstechnica.com/business/2011/12/huge-portions-of-web...
- meowface 13y ago
  Agreeing with the other statement: a JSON deserializer should never be executing arbitrary code as part of a feature of the deserializer. YAML, Python pickle, PHP serialization, etc. all allow serialization of arbitrary class instances by default, but JSON only allows simple data types. So, no clue where you're getting that from.
Shivetya 13y ago
which platforms? Really I am curious. Checking our XML in processors and there is nothing there that could lead to execution of what is within the XML. Are there examples somewhere I can see to understand how this is even possible?

So by default many XML libraries essentially allow remote code execution? How in the world is that ok? How is that the standard?

by eieio 13y ago

So by default many XML libraries essentially allow remote code execution? How in the world is that ok? How is that the standard?

yen223 13y ago

Not just XML, JSON parsers are notoriously vulnerable as well.

euank 13y ago
Citation needed. There have been many vulnerabilities in YAML parsers for ruby because they let you encode actual objects / code. JSON, despite being "Javascript object notation", can't actually encode full code/objects. You only have a few datatypes: (off the top of my head) bools, strings, numbers, arrays, key/value dicts. None of these are dangerous or difficult to parse. What you might be thinking about is the recent Ruby on Rails vulnerability which was caused by transforming JSON into YAML and then parsing the YAML. It would be more accurate to say the YAML parser was vulnerable. Your claim that "JSON parsers are notoriously vulnerable" implies that this is a common occurrence as well, not just a single incidence. I personally don't see it as likely because JSON has pretty much no features compared to xml; the surface area is tiny.
- psuter 13y ago
  Not exactly remote execution, but the parsing and construction of key/value dictionaries can be and has been exploited [1]. [1] http://arstechnica.com/business/2011/12/huge-portions-of-web-vulnerable-to-hashing-denial-of-service-attack/ http://arstechnica.com/business/2011/12/huge-portions-of-web...
meowface 13y ago
Agreeing with the other statement: a JSON deserializer should never be executing arbitrary code as part of a feature of the deserializer. YAML, Python pickle, PHP serialization, etc. all allow serialization of arbitrary class instances by default, but JSON only allows simple data types. So, no clue where you're getting that from.

Shivetya 13y ago

which platforms? Really I am curious. Checking our XML in processors and there is nothing there that could lead to execution of what is within the XML. Are there examples somewhere I can see to understand how this is even possible?