ajt has asked for the wisdom of the Perl Monks concerning the following question:

I've got involved in a "B2B" project late in the project. The customer generates an order in BizTalk XML, POSTs it to us and it is handled by the SAP Biztalk Connector (BC), and then goes into the live production SAP system.

Perl got involved in this as it recieves the external POST verifies that it's XML, logs things, and sends a response to the client. It then does the actual POST to the SAP BC system, instead of a direct customer POST to BC.

After several posts to the Monsatry, and some very useful tips back we now have a functioning system. Many thanks in arrears...

Ovid's recent (OT) Security Rant has made me fearful. I didn't design the system, but as we found out in testing already, the SAP BC system is quite fragile, and I don't want someone placing an XML file (deliberatly or accidentally) into the system that will break the underlying DB.

Last time I looked there wasn't a stable Perl XML validator, plus if the XML isn't valid BC will reject it, my really worry is with a valid XML file that gets imported sucessfully into the DB and breaks the underlying SAP system.

If I run the XML file though a "de-tainting like" process, only letting through letters, numbers, and enough symbols to maintain valid XML, is this safe enough or is it still possible to comprimise the the DB?

Many thanks in advance for any comments. I know you can't be 100% secure, but I'd like to think we are as secure as is sensible.

It's probably just me being paranoid, but no one else at work seems to be as worried about security as I am.....

  • Comment on How to protect backend DB from hacks or accidents

Replies are listed 'Best First'.
Re: How to protect backend DB from hacks or accidents
by mce (Curate) on Dec 06, 2001 at 17:22 UTC
    Hi there,

    I think you should try to identify two possible situations. One where an invalid XML leads to possible system problems (or db), and one where an invalid XML leads to possible SAP BC problems. Since I don't know this SAP BV, the latter is hard to figure out.

    The first one depends on how you upload the XML data in the database. There are several post on CGI/DBI/security, fe this. And detainting this will prevent unwanted db actions (like drop table )

    Since an upload of XML data is merely an upload of strings, detainting it fully depends on how the application handles the strings it reads from the database.

    I hope this helps, (a little bit :-) )
    ---------------------------
    Dr. Mark Ceulemans
    Senior Consultant
    IT Masters, Belgium

[reply]
Book recommendation
by Fletch (Bishop) on Dec 06, 2001 at 19:44 UTC

    A tangentally relevant book recommendation: Secrets and Lies (ISBN 0471253111) by Schneier (author of Applied Crypto). Unlike AC which explains cryptography and algorhithms, S&L goes into why crypto itself won't make a system secure.

    Feh, that's three books I've been meaning to write up Book Reviews for.

[reply]
Re: How to protect backend DB from hacks or accidents
by atcroft (Abbot) on Dec 06, 2001 at 23:18 UTC

    First of all, that you are concerned about security is a good thing. If more people took security seriously, we would likely have to spend less time on patching security issues, and have more time to produce better systems-but I digress there.

    Reading your post, does (a) the BizTalk XML system send the output and send it to the script(s), or (b) are they using that (possibly on a different system) and posting the results to your scripts? If the former, then one thing would be to insure that the data is coming only from that system, not from anywhere else.

    It sounds more like the case is the latter, though, in which case my feeling would be to perhaps have it act as a filter to check the data against some form of template to make sure all necessary fields exist, and that the data is of a type appropriate for each field (alphanumerics where expected, no alphabetics in numeric-only fields, or numerics in alphabetic-only fields, etc.) and reasonable.

    Hopefully other, more experienced monks can provide you better or more detailed suggestions. In any case, good luck in your search for this knowledge.

[reply]
Re: How to protect backend DB from hacks or accidents
by Anonymous Monk on Dec 07, 2001 at 03:26 UTC
    XML in Perl has changed a *lot* recently. Check XML::LibXML and XML::Xalan (or is it Xerces - I can never keep them straight).
[reply]

Back to Seekers of Perl Wisdom