Chrome unlikely to support XPath 3.1

Re:Chrome unlikely to support XPath 3.1 by donatj on Sunday November 01, 2020 @09:49AM (#24959800)

XML is undeniably a huge attack vector with a shrinking user base. I think that’s a very valid argument for not expanding its surface area.

[ Parent | on HN ]

Re:Chrome unlikely to support XPath 3.1 by richx on Sunday November 01, 2020 @02:17PM (#24961746)

Is it an attack vector? Can you elaborate further?

[ Parent | on HN ]

Re:Chrome unlikely to support XPath 3.1 by barefootliam on Sunday November 01, 2020 @03:21PM (#24962164)

No. XML libraries increase the attack _surface_, but XML itself is passive. There was a famous "billion laughs" attack, but JavaScript was also vulnerable to this, as is any language that lets you concatenate strings. The usual fix is a max size on such strings. There are a couple of other potential vulnerabilities, such as the ability to access the content of any URL, including file://etc/group, but again JavaScript has that too.

[ Parent | on HN ]

Re:Chrome unlikely to support XPath 3.1 by namedgraph on Thursday November 05, 2020 @09:28AM (#24998520)

Exactly

[ Parent | on HN ]