Re: Security: Atom injection attacks

[James M Snell <jasnell@xxxxxxxxx>]

So long as you're not suggesting that we need to solve the problem, +1.
Proposed language would be helpful :-D

- James

Elliotte Harold wrote:
> 
> I think we need to consider the possibility of SQL and other injection
> attacks using APP as a vector and something to section 15 to cover this.
> 
> A lot of APP servers and possibly some clients too will sit in top of
> SQL and XQuery databases. A lot of implementations are going to read the
> data out of the various elements, stuff it into a SQL statement using
> PHP string concatenation, and throw it at a database. And there's
> absolutely nothing in Atom to stop any of these fields from containing
> quotes, semicolons, brackets, and "DELETE * FROM CUSTOMERS"
> 
> We don't need to solve this problem in APP, but I do think we need to
> acknowledge it, and warn implementers to be aware of it in the same way
> we warn implementers to be aware of much less serious problems like
> replay and spoofing attacks.
>