XML is just a way of storing data in a hierarchical method. It's completely unrelated to the issue at hands - the router would still have no way of knowing if a given value in the restored backup is a correct value, or not.
Taken on its own, you are correct. XML is just a way to structure data. That said, there exist a set of supporting technologies to validate (XSD) and transform (XSLT) XML data which can facilitate a solution to this problem.
To be clear, XML data storage is just
a potential solution. It is not the
only valid approach. There may even be approaches better suited to the hardware limitations of these devices. The problem here is that there doesn't appear to be any validation of user provided input. Which is poor design and limits the usefulness of the backup/restore feature.
Let's take a concrete example. Let's say that there is an nvram value that sets a clock frequency to 600 MHz. The manufacturer finds out that 600 MHz is not stable, so decide to default to 580 MHz instead with a new firmware. So they recommend people reset to factory default, which means the setting will then get the proper default value of 580 MHz. If you restore a saved backup, you get your clock once again at 600 MHz, meaning your stability issues will not be resolved. Having the backup stored as binary or XML doesn't change anything - the router will still read from the backup that "clock=600", and would reapply that incorrect value.
Yes. Unvalidated data in any format, is unvalidated data. The application of unvalidated data from user space is bad and can lead to poor results. There are many ways to approach this problem, XML is just one.
For e.g. say we have the setting document below:
Code:
<root>
<clock>600</clock>
</root>
If this document was validated w/ XSD prior to application the developer would just change the schema def such that 600 was no longer a valid value. (Note this is unnecessarily verbose).
Code:
...
<xs:element name="clock">
<xs:simpleType>
<xs:restriction base="xs:integer">
<xs:minInclusive value="580"/>
<xs:maxInclusive value="580"/>
</xs:restriction>
</xs:simpleType>
</xs:element>...
It is also possible to use XSLT to reset/remove values if they should now be ignored. So stripping out <clock> or changing it to 580 if the current value != 580 are both simple tasks.
Again, this isn't strictly the domain of XML, it's just one potential solution to validate user input in a structured way. Any mechanism where data can be serialized, deserialized and validated will work - pick your favorite (JSON is another popular method). The important part is that any data that has been to userland gets checked - not doing that is poor design. This is a basic "best practice" of software development, it confuses me that anyone would argue this point.
If a low-level default value was changed in a new firmware release, the router has no way of telling if the value it would be about to apply from that backup is valid or not.
I disagree with this completely. Sanity checking values is a fundamental part of writing good software. Values that users shouldn't touch, shouldn't be persisted (what's the point if they aren't portable and only cause problems?). Anything they can touch should be validated before reapplication.
There are myriad methods to accomplish this, XML is just one. The problem here is that the mechanism to save/restore settings is implemented in a way that makes it not terribly useful. Fixing that isn't complicated.