[generguide-devel] Re: Sample files

[Cameron S. <ca...@sh...>]

I was not actually looking for problems with XXE, I was hoping we could find 
solutions.  :)

You have given a example of using ENTITIES to include files.  What we have 
been doing with generguide is only including a variable string.  Eg: "Project 
Name".  Only problem is XXE doesn't process these ENTITIES.  Attached is one 
of the files, and the entities.ent

On Saturday 27 Sep 2003 7:13 pm, you wrote:
> Attached samples files should demonstrate the problems with ENTITIES within
> XXE.
>
> Files:
> root.xml
> file1.xml
> file2.xml
> file3.xml
>
> When you open root.xml you will get the message about &yes_nesting; if you
> open the file and save it to a new file, say root1.xml. You will see that
> file3.xml (nested in file2.xml) will not be an ENTITY listed in root1.xml.
>
> The only way that XXE supports ENTITIES is if all are direct children of
> the root.xml. Even then you cannot edit them directly.
>
> The root.xml is valid, but XXE is broken.
>
> This is why I don't like it as an Authoring tool. It makes modular
> documentation, based on the ENTITY method impossible to manage. The most
> you can hope for from XXE is to be able to view your documents, but then I
> can do that in xhtml/html. Editing and saving root.xml, will break the
> integrity of my document content as file3.xml is missing. I only use XXE to
> view and edit when the document does not contain nested ENTITIES like
> file3.xml.
>
> Hope this helps.
>
> Sean Wheller

-- 
Cameron Shorter              http://cameron.shorter.net
Open Source Developer        http://generguide.sourceforge.net
                             http://mapbuilder.sourceforge.net
                             http://geotools.org
Senior Software Engineer     http://www.adi-limited.com