Extensible Markup Language (XML) has emerged as the standard way to transfer data and metadata between systems. XML is a rich standard, and its extensibility has led to various additions, including schemas and query languages. You may have already used it without knowing it. XML underpins Web services, .NET configuration files, and even IIS7 configuration. However, as you add XML support to your application, you are adding another vector for attack and potential vulnerabilities. Like any input, XML should be considered untrusted until you validate and sanitize it.
In this chapter, you will learn about the following:
How to accept and validate XML
How to query XML safely
How to sign XML documents to ensure them against tampering
How to encrypt XML to prevent eavesdropping
This chapter will only concentrate on the security aspects of XML. For a more detailed exploration of XML and all its associated technologies, Professional XML by Bill Evjen, Kent Sharkey, Thiru Thangarathinam, Michael Kay, Alessandro Vernet, and Sam Ferguson (Indianapolis: Wrox, 2007) is highly recommended.
Like any input, XML should be validated before trusting and using it. XML has two validation points:
Is it "well-formed"?
Is it "valid"?
An XML document is said to be well-formed when it conforms to the XML syntax specification, and contains no references to external resources — unless a document type definition (DTD) is specified.
Following is an example: