←back to thread

Security issues with electronic invoices

(invoice.secvuln.info)
91 points todsacerdoti | 1 comments | 12 Dec 25 20:28 UTC | HN request time: 0.201s | source
Show context
tnorgaard ◴[12 Dec 25 21:41 UTC] No.46249333[source]▶
This talk seems set out to prove that "XML is Bad". Yes XML-DSig isn't great with XPaths, but most of these attack vectors has been known for 10 years. There is probably a reason why the vulnerabilities found where in software not commonly used, e.g. SAP. Many of the things possible with XML and UBL simply isn't available in protobuf, json. How would you digitally sign a Json document and embed the signature in the document?

The article nor the talk appear to reference the XML standard that EN 16931 is built upon: Universal Business Language, https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=... - which is freely available. Examples can be found here: https://github.com/Tradeshift/tradeshift-ubl-examples/tree/m... . It is a good standard and yes it's complex, but it is not complicated by accident. I would any day recommend UBL over IDOC, Tradacom, EDIFACT and the likes.

replies(6): >>46250010 #>>46250248 #>>46250356 #>>46250567 #>>46251591 #>>46253809 #
1. xorcist ◴[13 Dec 25 11:27 UTC] No.46253809[source]▶
> XML-DSig isn't great with XPaths

Or at all.

> How would you digitally sign a Json document and embed the signature in the document?

Preferrably you wouldn't because that's a really bad idea.

That said, this type of support-every-conceivable-idea design-by-committee systems would be equally bad built on json or anything else. That much is true.

There's probably no silver bullet here. But that is still not an excuse for XML-Sig.