[bdbxml] Security in XML Database

[Tobias]

Hi,

I'm writing a web application with PHP and DBXML and I wonder how secure
it is.

I have 2 kinds of user input:
- keywords, used in the "where" clause of XQueries
- XML documents from different sources, which are Schema validated and
then put into the container

I use $Context->setVariableValue to insert the user input into the XQueries.

The data in the database isn't secret and XQuery can't change the
database, so I think the only real problem could be the XML documents.

Are there any security risks by this? Can something similar to an SQL
injection happen? How do you secure your database?

Thank you,
Tobias Neumann




------------------------------------------
To remove yourself from this list, send an
email to xml-unsubscribe-***@public.gmane.org

[George Feinberg]

Tobias,

I'm not sure if this addresses your concern specifically, but
you can do at least a couple of things:

1. use file protections to not allow random
processes to access your containers or
environment files.
2. Encrypt your containers.

Because BDB XML is a library, it is assumed that
any security-related mediation with regards to data put into a container
is being done by the application.
The techniques above help safeguard against attacks from
other processes.

Regards,

George

Post by Tobias
Hi,
I'm writing a web application with PHP and DBXML and I wonder how secure
it is.
- keywords, used in the "where" clause of XQueries
- XML documents from different sources, which are Schema validated and
then put into the container
I use $Context->setVariableValue to insert the user input into the XQueries.
The data in the database isn't secret and XQuery can't change the
database, so I think the only real problem could be the XML documents.
Are there any security risks by this? Can something similar to an SQL
injection happen? How do you secure your database?
Thank you,
Tobias Neumann

------------------------------------------
To remove yourself from this list, send an
email to xml-unsubscribe-***@public.gmane.org

[Tobias]

George,

I took care that the container can't be downloaded and access from other
processes is the problem of the server administrator.

Post by George Feinberg
Because BDB XML is a library, it is assumed that
any security-related mediation with regards to data put into a container
is being done by the application.

My question is, what do I have to look for? What could be dangerous?

Bye,
Tobias

Post by George Feinberg
Tobias,
I'm not sure if this addresses your concern specifically, but
1. use file protections to not allow random
processes to access your containers or
environment files.
2. Encrypt your containers.
Because BDB XML is a library, it is assumed that
any security-related mediation with regards to data put into a container
is being done by the application.
The techniques above help safeguard against attacks from
other processes.
Regards,
George

Post by Tobias
Hi,
I'm writing a web application with PHP and DBXML and I wonder how secure
it is.
- keywords, used in the "where" clause of XQueries
- XML documents from different sources, which are Schema validated and
then put into the container
I use $Context->setVariableValue to insert the user input into the XQueries.
The data in the database isn't secret and XQuery can't change the
database, so I think the only real problem could be the XML documents.
Are there any security risks by this? Can something similar to an SQL
injection happen? How do you secure your database?
Thank you,
Tobias Neumann

------------------------------------------
To remove yourself from this list, send an
email to xml-unsubscribe-***@public.gmane.org

[George Feinberg]

Post by Tobias
George,
I took care that the container can't be downloaded and access from other
processes is the problem of the server administrator.

Post by George Feinberg
Because BDB XML is a library, it is assumed that
any security-related mediation with regards to data put into a container
is being done by the application.

My question is, what do I have to look for? What could be dangerous?

If you have control of the files, and the only user inputs are
predicates for "where"
clauses, and documents, there is not much to worry about.

If you are using BDB XML's schema validation, you should know that
if the parser cannot find the referenced DTD, it backs out to well-
formed
parsing, so potentially a user could supply a bad doc with a bad DTD
reference, but it still needs to be well-formed XML.

George



------------------------------------------
To remove yourself from this list, send an
email to xml-unsubscribe-***@public.gmane.org