Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out there seem frequent and strong, I still see the occasional site go down, get defaced, etc. (usually from SQL injection attacks).

This has led me to look at Get-Simple CMS, which has the unique difference of housing data in XML files. I realize folks won't be able to speak about specific vulnerabilities related to this CMS, but in general what are the pros and cons with regard to security and an XML driven CMS?

share|improve this question
    
I don't think this needs to be community wiki –  John Conde Oct 11 '10 at 13:54
    
how do i remove it? –  binaryorganic Oct 12 '10 at 19:24
add comment

1 Answer 1

up vote 3 down vote accepted

It's really the same as any form of data store. Do you protect it from malicious data and attack? One thing that comes to mind is how are the XML files stored?

  • Outside of the web root - best
  • Inside the web root but protected through .htaccess - not as good but ok
  • Inside the web root and hidden through obscurity - not good at all

The data's integrity and malicious user input issues still apply. They may not be able to to SQL injections but they can still do XXS attacks as that is independent of the storage mechanism.

I'd have to say there is no advantage or disadvantage to using XML for storage from a security point of view. (From a non-security point of view I would think XML is slower to work with then a relational database especially for large data stores).

share|improve this answer
    
Thanks! You're definitely right about the speed issue, but I'm using it for smallish sites anyhow. My math was that the risk of injections + XSS (traditional CMS) was greater than risk of XSS (XML CMS). –  binaryorganic Oct 11 '10 at 14:01
    
If the CMS is established the odds are any SQL injection vulnerabilities would have been exposed and fixed by now. So unless you're rolling your own CMS I wouldn't let something like that be a factor in your decision. –  John Conde Oct 11 '10 at 14:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.