1.Large XML Documents 成为 DoS attack
Have a client post an XML doc of extreme length/depth <foo><foo><foo>...</foo></foo></foo> This does bad things to DOM parsers and memory consumption on the server: a DoS attack. The issue here is that the costs of handling a large XML document are much greater than the cost of generating one.
如果客户端发送一个无限长和无线深度的<foo><foo><foo>...</foo></foo></foo> 样子的xml给服务器，那么就会造成服务器内存消耗光，那么这就成为DoS attack攻击的一种。处理一个大xml的代价比生成一个大xml的代价要大得多。
2.Entity Expansion Attacks.
If an XML doc header declares some recursive entity declarations, and the file refers to them, then bad things happen. (Most of XML parser became immune to this, which will throw exception. )
An recursive entity value is like following:
<!ENTITY recursiveEntity “1+&recursiveEntity;”> //递归的实体声明
如果一个xml头部声明一些递归的实体引用，那么就会发生坏事情。不过幸好大多数xml分析器对此免疫，会抛出异常。
3. Entities referring to the filesystem.
Here you declare an entity referring to a local file, then expand it. Result: you may be able to probe for files, perhaps even get a copy of it in the error response. This is high risky.
Though some XML related software does not support entities ( Like axis , which resists this. ), If your code has any way of resolving URLs from incoming messages, you may recreate this problem.
如果声明一个实体引用指向一个本地文件，然后展开它。结果是，你可以成为文件的探针，甚至可以在错误信息的回复中得到文件的拷贝。风险很大。
尽管许多xml相关软件不支持实体，但如果你的代码以任何方式来处理收到信息中的urls，那么你可能有碰到这个问题。
[返回] 中文XML论坛 - 专业的XML技术讨论区 →
XML.ORG.CN讨论区 - XML技术 → 『 DTD/XML Schema 』 → XML 的安全弱点和漏洞
(订阅本版)
2007/10/30 11:57:00
顶端 
XML 的安全弱点和漏洞(1690字) － hongjuesir，2007年10月30日
新浪微博
