Iranian ransomware crew reemerges, promises big bucks for attacks on US or Israel
An Iranian ransomware-as-a-service operation with ties to a government-backed cyber crew has reemerged after a nearly five-year hiatus, and is offering would-be cybercriminals cash to infect organizations in the US and Israel.…
CodeSOD: The XML Dating Service
One of the endless struggles in writing reusable API endpoints is creating useful schemas to describe them. Each new serialization format comes up with new ways to express your constraints, each with their own quirks and footguns and absolute trainwrecks.
Maarten has the "pleasure" of consuming an XML-based API, provided by a third party. It comes with an XML schema, for validation. Now, the XML Schema Language has a large number of validators built in. For example, if you want to restrict a field to being a date, you can mark it's type as xsd:date. This will enforce a YYYY-MM-DD format on the data.
If you want to ruin that validation, you can do what the vendor did:
<xsd:simpleType name="DatumType"> <xsd:annotation> <xsd:documentation>YYYY-MM-DD</xsd:documentation> </xsd:annotation> <xsd:restriction base="xsd:date"> <xsd:pattern value="(1|2)[0-9]{3}-(0|1)[0-9]-[0-3][0-9]" /> </xsd:restriction> </xsd:simpleType>You can see the xsd:pattern element, which applies a regular expression to validation. And this regex will "validate" dates, excluding things which are definitely not dates, and allowing very valid dates, like February 31st, November 39th, and the 5th of Bureaucracy (the 18th month of the year), as 2025-02-31, 2025-11-39 and 2025-18-05 are all valid strings according to the regex.
Now, an astute reader will note that this is a xsd:restriction on a date; this means that it's applied in addition to ensuring the value is a valid date. So this idiocy is harmless. If you removed the xsd:pattern element, the behavior would remain unchanged.
That leads us to a series of possible conclusions: either they don't understand how XML schema restrictions work, or they don't understand how dates work. As to which one applies, well, I'd say 1/3 chance they don't understand XML, 1/3 chance they don't understand dates, and a 1/3 chance they don't understand both.
[Advertisement] Picking up NuGet is easy. Getting good at it takes time. Download our guide to learn the best practice of NuGet for the Enterprise.Julian McMahon's family break their silence with heartbreaking 12-word statement following his death aged 56
What happened when a Schizophrenic Buckingham Palace intruder met the Queen: Inside the shocking royal security blunder where a man broke in TWICE
Revealed: How a 'pink-faced' Queen Elizabeth swooned over the 'fairytale' Prince Philip during their first meeting
I never travel without Apple AirTags - and they're 29% off in the Amazon Prime Day sale
What Trump said to Obama during intimate moment at Jimmy Carter's funeral that stunned onlookers
The children sitting on six-figure Junior Isas - and how to grow a nest egg for your offspring
Newcastle Building Society opens new giant super branch
The controversial 'new' fashion trend sweeping the royal families right now - and the stars love it too
Flood victim's 30 minutes of terror on phone to 911 as waters rose…but they still couldn't save her
Female hiker waits two days on cliff face with suffering horrifying injury as five helicopters attempt rescue
Leonardo DiCaprio makes low-profile appearance at Lauren Sanchez's Paris dinner party in a hat and face mask
Chipmaker GlobalFoundries acquires chip designer MIPS
GlobalFoundries has acquired chip design firm MIPS, creating a company that both designs and creates semiconductors.…