XML is a markup language, not a pure programming language. This means that XML files are usually marked-up “data” files, rather than procedural logic.
Kiuwan provides native support for processing XML files, i.e off-the-shelf XML rules that will be fired if the application source code contains XML files.
To apply those rules, Kiuwan uses an XML parser that checks if the XML files are well-formed.
In case an XML file is not well-formed or is not compliant to XML format, Kiuwan will notice it and that file will not be further processed by Kiuwan’s XML rules.
There are some well-known XML files, i.e. standardized XML files broadly used by public frameworks and/or products. As soon as XML is standardized, Kiuwan is able to provide rules that check for specific conditions.
Kiuwan provides +20 XML rules addressing specific conditions for Struts1 and XSLT.
To see these rules, go to Models Management > Rules. Select CQM and search for XML in the Language field.
Why are the rules deactivated?
If your application is using any of those frameworks (struts1 and/or xslt), you can activate them and Kiuwan will apply those rules when finding XML files within your application code.
- For example, there are rules that check for the misconfiguration of security properties in web.xml descriptors. These rules do process this standard XML file (web.xml) trying to find misconfigurations.
- Another example is XML SOAP messages (WSDL files). Kiuwan provides rules that check specific conditions on such files (signatures, encryption, etc,).
In case you need to check specific conditions for your own XML files, you can build your own rules using Kiuwan APIs.