On Tue, 22 Jun 2004 23:05:48 +0100, Tim Meadowcroft wrote
As an example of the first one at least, consider the following XML
record
<?xml version="1.0"?>
<!DOCTYPE record [ <!ENTITY entries SYSTEM
"http://www.schmerg.com/entries.txt";> ] >
<record> &entries; </record>
<snip>
So my SPF XML parser now needs to understand arbitrary file
inclusions including how to retrieve such files - how many of http,
ftp, tftp, smb etc protocols have I just included, and how many of
these have buffer overflow and similar exploits ?
Not only that, but we're now back in the situation where you have to make an
expensive TCP call to check an SPF record...a situation I thought we were
trying to avoid?
It sounds like if SPF is going to use XML, there needs to be defined an XML
subset that all records have to adhere to. But of course, then it's not
really XML anymore.