OWASP Periodic Table of Vulnerabilities - SOAP Array Abuse, XML Attribute Blowup, XML Entity Expansion

Return to Periodic Table Working View

Root Cause Summary
Some features of the XML specification can be abused if XML parsers do not safely handle recursive element definitions or array declarations.

Browser / Standards Solution
None

Perimeter Solution
Perimeter technologies should perform strict schema validation against all incoming XML documents. The validation process should enforce the following configurable limits on XML object definitions:
 * The maximum array size (as a product of the number of rows and columns)
 * The maximum number of elements
 * The maximum number of attributes per element
 * The maximum size of entity definitions
 * The maximum number of references to entity definitions

Generic Framework Solution
None

Custom Framework Solution
None

Custom Code Solution
None

Discussion / Controversy
None