Re: [bdbxml] Security in XML Database

George,

I took care that the container can't be downloaded and access from other
processes is the problem of the server administrator.

> Because BDB XML is a library, it is assumed that
> any security-related mediation with regards to data put into a container
> is being done by the application.

My question is, what do I have to look for? What could be dangerous?

Bye,
  Tobias


George Feinberg schrieb:
> Tobias,
> 
> I'm not sure if this addresses your concern specifically, but
> you can do at least a couple of things:
> 
> 1.  use file protections to not allow random
> processes to access your containers or
> environment files.
> 2.  Encrypt your containers.
> 
> Because BDB XML is a library, it is assumed that
> any security-related mediation with regards to data put into a container
> is being done by the application.
> The techniques above help safeguard against attacks from
> other processes.
> 
> Regards,
> 
> George
> 
>> Hi,
>>
>> I'm writing a web application with PHP and DBXML and I wonder how secure
>> it is.
>>
>> I have 2 kinds of user input:
>> - keywords, used in the "where" clause of XQueries
>> - XML documents from different sources, which are Schema validated and
>> then put into the container
>>
>> I use $Context->setVariableValue to insert the user input into the
>> XQueries.
>>
>> The data in the database isn't secret and XQuery can't change the
>> database, so I think the only real problem could be the XML documents.
>>
>> Are there any security risks by this? Can something similar to an SQL
>> injection happen? How do you secure your database?
>>
>> Thank you,
>>   Tobias Neumann
>>
> 
> 


------------------------------------------
To remove yourself from this list, send an
email to [email protected]