We have comments from security team:
For: _vti_bin/copy.asmx
Implications Processing XML documents can be computationally expensive. Attackers may take advantage of schemas that allow unbounded elements by supplying an application with a very large number elements causing the application to exhaust system resources. The following is an example of a schema that allows unbounded bar elements.
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" >
<xs:element name="foo" >
<xs:complexType>
<xs:sequence>
<xs:element name="bar" maxOccurs="unbounded" />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>Recommendations Limit maxOccurs to a reasonable number. The following is an example of a schema that allows 50 bar elements.
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" >
<xs:element name="foo" >
<xs:complexType>
<xs:sequence>
<xs:element name="bar" maxOccurs="50" />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:schema>For: _vti_bin/lists.asmx
Implications The element means arbitrary tags can be included in a valid document. Permitting arbitrary content makes it easier for attackers to perform attacks like XML injection. Example 1: Imagine you are using the following schema for validation.
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="cart" >
<xs:complexType>
<xs:sequence>
<xs:element name="itemID" maxOccurs="1" />
<xs:element name="price" maxOccurs="1" />
<xs:element name="description" maxOccurs="1"/>
<xs:any minOccurs="0"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="description" type="xs:string"/>
<xs:element name="name" type="xs:string"/>
<xs:element name="price" type="xs:decimal"/>
<xs:element name="code" type="xs:string"/>
</xs:schema>Since this schema uses the element, the following XML documentation will be considered valid.
<?xml version=\"1.0\" ?>
<cart>
<itemID>123</itemID>
<price>50.00</price>
<price>1.0</price>
</cart>This is especially dangerous when using SAX parsers since later nodes will overwrite previous nodes.
Recommendations Explicitly define permissible elements instead of using the element. Example 2: In order to fix Example 1, replace the element with a concretely defined element such as .
<?xml version="1.0"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<xs:element name="cart" >
<xs:complexType>
<xs:sequence>
<xs:element name="itemID" maxOccurs="1" />
<xs:element name="price" maxOccurs="1" />
<xs:element name="description" maxOccurs="1"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:element name="description" type="xs:string"/>
<xs:element name="name" type="xs:string"/>
<xs:element name="price" type="xs:decimal"/>
<xs:element name="code" type="xs:string"/>
</xs:schema>Could we update those 2 files as suggestions from security team?