Hacker News new | ask | show | jobs
by eieio 4525 days ago
So by default many XML libraries essentially allow remote code execution?

How in the world is that ok? How is that the standard?

2 comments

which platforms? Really I am curious. Checking our XML in processors and there is nothing there that could lead to execution of what is within the XML.

Are there examples somewhere I can see to understand how this is even possible?

Not just XML, JSON parsers are notoriously vulnerable as well.
Citation needed.

There have been many vulnerabilities in YAML parsers for ruby because they let you encode actual objects / code.

JSON, despite being "Javascript object notation", can't actually encode full code/objects. You only have a few datatypes: (off the top of my head) bools, strings, numbers, arrays, key/value dicts. None of these are dangerous or difficult to parse.

What you might be thinking about is the recent Ruby on Rails vulnerability which was caused by transforming JSON into YAML and then parsing the YAML. It would be more accurate to say the YAML parser was vulnerable.

Your claim that "JSON parsers are notoriously vulnerable" implies that this is a common occurrence as well, not just a single incidence.

I personally don't see it as likely because JSON has pretty much no features compared to xml; the surface area is tiny.

Not exactly remote execution, but the parsing and construction of key/value dictionaries can be and has been exploited [1].

[1] http://arstechnica.com/business/2011/12/huge-portions-of-web...

Agreeing with the other statement: a JSON deserializer should never be executing arbitrary code as part of a feature of the deserializer. YAML, Python pickle, PHP serialization, etc. all allow serialization of arbitrary class instances by default, but JSON only allows simple data types.

So, no clue where you're getting that from.