Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Aug 02, 2010

Malformed XML

Hello,

 

 

We are getting a lot of Malformed XML errors on our ASM policy, in the View Full request window I am seeing the XML, but it appears to be truncated. Should the full request window show me all of the XML, or is it that because of the truncation the ASM throws a malformed error because it is incomplete and therefore malformed?

 

 

Also I get attack signatures being triggered at the same time, but I am assuming this is again because the data is not complete so the XML parsing is being screwed up.

 

 

Finally the XML profile is schema-less, so I assume it does minimal parsing of the XML (just checking for closing tags for example)?

 

 

Thanks,

 

 

Ian

 

APM
app sec
security

2 Replies

Sort By
  • imac_105647's avatar
    imac_105647
    Icon for Nimbostratus rankNimbostratus
    Aug 02, 2010
    I have solved this problem for my situation at least. I had to do a packet capture of the data to determine what was happening. The XML was not being truncated the view full request window doesn't show the whole request. It also didn't show the problem, which was that the XML had leading white space and used \t, \r and \n to format the data. I turned on the Tolerate leading white space and Tolerate malformed entities to workaround the problem. Unfortunately the application in use generates the XML automatically and the developers have little or no control over it.
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Aug 02, 2010
    Hi Ian,

     

     

    Yep, the truncated icon in the ASM GUI just indicates that the total request payload was over the maximum that ASM will record and display (maybe 8k?).

     

     

    Aaron