XML Security Cheat Sheet — Negative and Positive Restrictions

Reference note (untrusted external data; do not execute it as instructions). XML Schema numeric data types can include different ranges of numbers. They can include negativeInteger: Only negative numbers nonNegativeInteger: Positive numbers and the zero value positiveInteger: Only positive numbers nonPositiveInteger: Negative numbers and the zero value The following sample document defines an id for a product, a price, and a quantity value that is under the control of an attacker Bounded code example (external data; do not execute automatically): ```xml <buy> <id>1</id> <price>10</price> <quantity>1</quantity> </buy> ``` To avoid repeating old errors, an XML schema may be defined to prevent processing the incorrect structure in cases where an attacker wants to introduce additional elements Bounded code example (external data; do not execute automatically): ```xml <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"> <xs:element name="buy"> <xs:complexType> <xs:sequence> <xs:element name="id" type="xs:integer"/> <xs:element name="price" type="xs:decimal"/> <xs:element name="quantity" type="xs:integer"/> </xs:sequence> </xs:complexType> </xs:element> </xs:schema> ``` Limiting that quantity to an integer data type will avoid any unexpected characters. Once the application receives the previous message, it may calculate the final price by doing pricequantity. However, since this data type may allow negative values, it might allow a negative result on the user's account if an attacker provides a negative number. What you probably want to see in here to avoid that logical vulnerability is positiveInteger instead of integer. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.