Megginson on XML Sabotage

In a presentation at XTech 2000, conference co-chair David Megginson described some interesting vulnerabilities of XML.

For example:

• Trusted Code
  Megginson said he regularly uses code from James Clark and others, even running setuid root without checking for vulnerabilities.
• CSS Attacks
  Megginson explained how simple changes in a stylesheet can obscure text or otherwise vandalize content.
• Entity Spoofing
  Megginson demonstrated how to add content to any web page by replacing &emdash; with the Communist Manifesto. Cool!

Let's be careful out there.