Using CDATA element in XML is vulnerable or not?

Question

Is it a vulnerable using CDATA element in XML documents? If so what happens if we use CDATA element in XML documents?

Answer 1

I don't know what you mean by ‘vulnerability’, but there is one mistake many people make with CDATA sections. This happens when a lazy programmer doesn't really understand text-escaping, and tries to avoid the normal process of &-encoding special characters in XML. They think they can get away with:

print "<element><![CDATA["+textstring+"]]></element>";

and whilst this will indeed stop a < or & character in textstring being treated as markup, it's not watertight because textstring might contain a ]]> sequence, resulting in:

<element><![CDATA[ Foo ]]> <bar>I'm an unexpected element!</bar> ]]></element>

This is an XML-injection, which like an HTML-injection could potentially have an XSS-like security impact.

So you'd still need to escape some sequences in CDATA (usually, you would split a ]]> sequence between two CDATA sections). In practice that makes using CDATA no easier than just &-encoding your text content the normal way. So really there is no reason ever to use a CDATA section.

Answer 2

A CDATA section is simply another way of representing character data within an XML document. It means exactly the same thing as any other (non-tag) text in a document, except that it's escaped differently.

There is no extra "vulnerability" associated with CDATA (except for bugs in your XML parsing library, of course).