Re: [bdbxml] Security in XML Database

> George,
>
> I took care that the container can't be downloaded and access from  
> other
> processes is the problem of the server administrator.
>
>> Because BDB XML is a library, it is assumed that
>> any security-related mediation with regards to data put into a  
>> container
>> is being done by the application.
>
> My question is, what do I have to look for? What could be dangerous?

If you have control of the files, and the only user inputs are  
predicates for "where"
clauses, and documents, there is not much to worry about.

If you are using BDB XML's schema validation, you should know that
if the parser cannot find the referenced DTD, it backs out to well- 
formed
parsing, so potentially a user could supply a bad doc with a bad DTD
reference, but it still needs to be well-formed XML.

George



------------------------------------------
To remove yourself from this list, send an
email to [email protected]