Beginning ASP.NET Security

Chapter 10. Securing XML

Extensible Markup Language (XML) has emerged as the standard way to transfer data and metadata between systems. XML is a rich standard, and its extensibility has led to various additions, including schemas and query languages. You may have already used it without knowing it. XML underpins Web services, .NET configuration files, and even IIS7 configuration. However, as you add XML support to your application, you are adding another vector for attack and potential vulnerabilities. Like any input, XML should be considered untrusted until you validate and sanitize it.

In this chapter, you will learn about the following:

• How to accept and validate XML

• How to query XML safely

• How to sign XML documents to ensure them against tampering

• How to encrypt XML to prevent eavesdropping

Note

This chapter will only concentrate on the security aspects of XML. For a more detailed exploration of XML and all its associated technologies, Professional XML by Bill Evjen, Kent Sharkey, Thiru Thangarathinam, Michael Kay, Alessandro Vernet, and Sam Ferguson (Indianapolis: Wrox, 2007) is highly recommended.

VALIDATING XML

Like any input, XML should be validated before trusting and using it. XML has two validation points:

• Is it "well-formed"?

• Is it "valid"?

Well-Formed XML

An XML document is said to be well-formed when it conforms to the XML syntax specification, and contains no references to external resources — unless a document type definition (DTD) is specified.

Following is an example:

<?xml ...