Re: Big comments

At 2:02 PM -0400 4/26/04, David Megginson wrote:

>What should a SAX parser do if an element or attribute name, 
>attribute value, or processing instruction data exceed Java's 
>limits, or the element nesting depth uses up the stack space?

The stack space is not an issue. It's possible to write a parser 
(especially a SAX parser) that does not use recursion and does not 
blow up no matter how deep the document.

>I think that this needs to be part of a general examination of XML 
>security issues, both inside and outside of Java and SAX.

I disagree. By their nature issues like this are specific to 
particular environments. What is an issue for C++ may not be an issue 
for Java and vice versa. What is an issue for SAX may not be an issue 
for DOM and vice versa. This is a big question so if you want to 
leave it to 2.0.3, fine. However, it needs to be a specific SAX 
discussion tailored to the needs of SAX. It should *not* be a general 
discussion tailored to the needs of all languages and APIs.
-- 

   Elliotte Rusty Harold
   [email protected]
   Effective XML (Addison-Wesley, 2003)
   http://www.cafeconleche.org/books/effectivexml
   http://www.amazon.com/exec/obidos/ISBN%3D0321150406/ref%3Dnosim/cafeaulaitA


-------------------------------------------------------
This SF.net email is sponsored by: The Robotic Monkeys at ThinkGeek
For a limited time only, get FREE Ground shipping on all orders of $35
or more. Hurry up and shop folks, this offer expires April 30th!
http://www.thinkgeek.com/freeshipping/?cpg=12297
_______________________________________________
List: sax-devel, [email protected]
See:  http://www.saxproject.org/
https://lists.sourceforge.net/lists/listinfo/sax-devel