Using CDATA element in XML is vulnerable or not?

Question

Is it a vulnerable using CDATA element in XML documents? If so what happens if we use CDATA element in XML documents?

Answer 1

I don't know what you mean by ‘vulnerability’, but there is one mistake many people make with CDATA sections. This happens when a lazy programmer doesn't really understand text-escaping, and tries to avoid the normal process of &-encoding special characters in XML. They think they can get away with:

print "<element><![CDATA["+textstring+"]]></element>";

and whilst this will indeed stop a < or & character in textstring being treated as markup, it's not watertight because textstring might contain a ]]> sequence, resulting in:

<element><![CDATA[ Foo ]]> <bar>I'm an unexpected element!</bar> ]]></element>

This is an XML-injection, which like an HTML-injection could potentially have an XSS-like security impact.

So you'd still need to escape some sequences in CDATA (usually, you would split a ]]> sequence between two CDATA sections). In practice that makes using CDATA no easier than just &-encoding your text content the normal way. So really there is no reason ever to use a CDATA section.

Answer 2

A CDATA section is simply another way of representing character data within an XML document. It means exactly the same thing as any other (non-tag) text in a document, except that it's escaped differently.

There is no extra "vulnerability" associated with CDATA (except for bugs in your XML parsing library, of course).

Answer 3

Vulnerable to what? An injection attack of some kind? CDATA tells the parser to pass the contents without parsing it, so if you're validating your XML I suppose the CDATA section misses out on the validation step.

The code that uses the XML stream should have some kind of business validation above and beyond the schema validation, so you're only at risk if you fail to check inputs before you use them.