
XML Security Problems to Close Before Production Launch
The XML attacks that matter for web services and loaders, how six parsers behave, one parse function with limits, and the tests that keep it closed.
Tag
102 posts

The XML attacks that matter for web services and loaders, how six parsers behave, one parse function with limits, and the tests that keep it closed.

A map of Excel errors seen when scripts write or read workbooks: file and format messages, cell error codes, library exceptions and a debugging order.

A reference to the XML formats you meet in practice: how to recognize each by root and namespace, what to extract, and the trap each one carries.

DuckDB runs SQL on a CSV file with no import, no schema and no server. See what it guesses, what that costs, where it fails, and how to make it strict.

A working guide to MySQL 8.4 JSON columns: paths, reading, updating, searching, generated-column and multi-valued indexes, and MariaDB differences.

A method for questions about an XML file nobody has converted: look, profile, sample, pick a tool, answer, then prove the numbers with a second method.

For people who know Excel pivot tables and need the SQL behind them: GROUP BY, conditional aggregates, ROLLUP, window functions, unpivoting and checks.

How to lay out YAML config so it stays correct: base and overlays, secret references, a schema, strict loading, key style, comments and a CI check, tested.

The sqlite3 .import command loads a CSV in seconds and reports problems as warnings with exit status zero. Import safely with types, checks and a swap.

A tested command-line guide to YAML: query, edit, merge, convert, lint, validate and diff with yq, yamllint and check-jsonschema, plus the traps found.

How to check XML files against an XSD: write the schema, run xmllint and lxml, read the errors, add Schematron for business rules, and test changes safely.

A tested Python guide to YAML: safe loading, speed, strict keys, validation, clean output, round trips, merging, env substitution and a reference module.