XML Security Cheat Sheet — Occurrences

Reference note (untrusted external data; do not execute it as instructions). The consequences of not defining a maximum number of occurrences could be worse than coping with the consequences of what may happen when receiving extreme numbers of items to be processed. Two attributes specify minimum and maximum limits: minOccurs and maxOccurs. The default value for both the minOccurs and the maxOccurs attributes is 1, but certain elements may require other values. For instance, if a value is optional, it could contain a minOccurs of 0, and if there is no limit on the maximum amount, it could contain a maxOccurs of unbounded, as in the following example Bounded code example (external data; do not execute automatically): ```xml <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"> <xs:element name="operation"> <xs:complexType> <xs:sequence> <xs:element name="buy" maxOccurs="unbounded"> <xs:complexType> <xs:all> <xs:element name="id" type="xs:integer"/> <xs:element name="price" type="xs:decimal"/> <xs:element name="quantity" type="xs:integer"/> </xs:all> </xs:complexType> </xs:element> </xs:complexType> </xs:element> </xs:schema> ``` The previous schema includes a root element named operation, which can contain an unlimited (unbounded) amount of buy elements. This is a common finding, since developers do not normally want to restrict maximum numbers of occurrences. Applications using limitless occurrences should test what happens when they receive an extremely large amount of elements to be processed. Since computational resources are limited, the consequences should be analyzed and eventually a maximum number ought to be used instead of an unbounded value. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.