Description

The software accepts XML from an untrusted source but does not validate the XML against the proper schema.

Extended Description

Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input.

Applicable Platforms
Language Class: All

Time Of Introduction

• Implementation

Related Attack Patterns

• CAPEC-99

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships

Demonstrative Examples   (Details)

1. The following code excerpt creates a non-validating XML DocumentBuilder object (one that doesn't validate an XML document against a schema).
2. The following code loads an XML file without validating it against a known XML Schema or DTD.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:
None