Is it possible to read xml file from different domains/directories?

Question

Information Security

My colleague, a "programmer", is spitting and trying to prove to me that it is not safe to read from his site and process an xml file located on his other site.
Both sites are on the same ftp account on the same hosting.
The xml file is located on site 1 in the xml folder, and information from it is displayed on site 2.
The file is read-only with rights 644
"programmer" writes to me:

Attackers will get access to the file and then they can slip you a script that will substitute your users. You can solve this problem in this way: move the xml file to the site where the information is displayed.

How will he get access to the file if he does not have access to ftp and the site's admin panel? In this case, you can put a script in any js, php file. How the file is read and output is another question, there is already a question of professionalism (xml validation, etc.).
Is he right about moving the file? I honestly laughed for a long time

Answer 1

Laughing together

Answer 2

if 2 sites are trying to communicate with one file, then it is logical to move it outside the public zones and work with it there. php is perfectly able to work within its working directory. You can generally wrap all this in an api on the third domain and give json. But the very idea of ​​one site accessing another is dangerous because of their connection, not hacks.

Answer 3

Your colleague is right. It's a kind of XSS hole.
And you laugh out of stupidity, not even realizing that they are LOCAL rights and do not play a role at all if it has webserera rights. Simply put, if the php script has access (should do something with it), then that's all, that's enough.

Answer 4

Перемещение файла однозначно ничем не поможет. если получить доступ к 1 то можно и получить доступ ко 2. Тем более в этом случае разумнее будет внедрить код в содержимое исполняемых файлов, а не в xml.
Зависит от того где получается на клиенте / сервере, какие операции над файлом, но вообще следует всегда валидировать содержимое(не доверять источнику) приводить к типу, фильтровать на потенциальные xss. зависит от использования данные.

Answer 5

Я конечно извиняюсь за такой глупый вопрос, но это единственное место, где ему могут авторитетно ответить.