How to defend against hacking if a user submits XML

Question

I have a feature where users can submit pure XML in a form. When my server gets the response I will validate it against a XML schema then I store it in the database. I never show the XML on a webpage unless it is in a form for editing. I use the XML to render html forms or text in a webpage and I will encode the text and never show the actual XML in a browser unless its for editing. Am I subject to alota of hacking? How can I better defend against this?

For example:

<criteria name="Performance" type="textbox">115 Horsepower</criteria>

Above will render either a table cell with the word 115 Horsepower in it or it my render a textbox with the word 115 Horsepower in it.

Answer 1

Think in the direction of some parts of XML missing and some parts repeating twice or more. Take care of those edge cases in your schema.

Answer 2

Here's one example of an attack vector for XML content:

http://en.wikipedia.org/wiki/Billion_laughs

Answer 3

The most likely "hacking" you should look out for is Persistent Cross-Site Scripting. Depending on how you're converting that XML into HTML, a malicious user could use it to create a tag or attribute that executes Javascript in the context of your domain. Make sure that you're only allowing a limited set of HTML tags and attributes to be created, and all data is properly sanitized before outputting as tag/attribute content.

It's hard to say exactly what you need to do without knowing all the details of your system, though. It would be best to have someone familiar with cross-site scripting review your code.