Forum Discussion
imac_105647
Nimbostratus
NimbostratusMalformed XML
Hello,
We are getting a lot of Malformed XML errors on our ASM policy, in the View Full request window I am seeing the XML, but it appears to be truncated. Should the full request window show me all of the XML, or is it that because of the truncation the ASM throws a malformed error because it is incomplete and therefore malformed?
Also I get attack signatures being triggered at the same time, but I am assuming this is again because the data is not complete so the XML parsing is being screwed up.
Finally the XML profile is schema-less, so I assume it does minimal parsing of the XML (just checking for closing tags for example)?
Thanks,
Ian
imac_105647I have solved this problem for my situation at least. I had to do a packet capture of the data to determine what was happening. The XML was not being truncated the view full request window doesn't show the whole request. It also didn't show the problem, which was that the XML had leading white space and used \t, \r and \n to format the data. I turned on the Tolerate leading white space and Tolerate malformed entities to workaround the problem. Unfortunately the application in use generates the XML automatically and the developers have little or no control over it.
hoolioCirrostratus
Hi Ian,
Yep, the truncated icon in the ASM GUI just indicates that the total request payload was over the maximum that ASM will record and display (maybe 8k?).
Aaron