/code-security

Prevent XML External Entity (XXE) Injection

XXE occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. Attackers can access local files, perform SSRF, or cause DoS.

Language: Java

DocumentBuilderFactory - Disallow DOCTYPE Declaration

Incorrect (vulnerable to XXE):

class BadDocumentBuilderFactory {
    public void parseXml() throws ParserConfigurationException {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        dbf.newDocumentBuilder();
    }
}

Correct (XXE disabled):

class GoodDocumentBuilderFactory {
    public void parseXml() throws ParserConfigurationException {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        dbf.newDocumentBuilder();
    }
}

References:

• CWE-611: Improper Restriction of XML External Entity Reference
• OWASP XXE Prevention Cheat Sheet
• Semgrep Java XXE Cheat Sheet

Language: Python

Native xml Library Usage

Incorrect (vulnerable to XXE):

def parse_xml():
    from xml.etree import ElementTree
    tree = ElementTree.parse('data.xml')
    root = tree.getroot()

Correct (safe usage):

def parse_xml():
    import defusedxml.ElementTree as ElementTree
    tree = ElementTree.parse('data.xml')
    root = tree.getroot()

References:

• CWE-611: Improper Restriction of XML External Entity Reference
• Python xml Documentation
• defusedxml on GitHub

Language: JavaScript

libxmljs - noent Option Enabled

Incorrect (vulnerable to XXE):

var libxmljs = require("libxmljs");

module.exports.parseXml = function(req, res) {
    libxmljs.parseXml(req.body, { noent: true, noblanks: true });
}

Correct (XXE disabled):

var libxmljs = require("libxmljs");

module.exports.parseXml = function(req, res) {
    libxmljs.parseXml(req.body, { noent: false, noblanks: true });
}

References:

• CWE-611: Improper Restriction of XML External Entity Reference
• OWASP XXE Prevention Cheat Sheet

Language: C#

XmlReaderSettings with DtdProcessing.Parse

Incorrect (vulnerable to XXE):

public void ParseXml(string input) {
    XmlReaderSettings rs = new XmlReaderSettings();
    rs.DtdProcessing = DtdProcessing.Parse;
    XmlReader myReader = XmlReader.Create(new StringReader(input), rs);

    while (myReader.Read()) {
        Console.WriteLine(myReader.Value);
    }
}

Correct (XXE disabled):

public void ParseXml(string input) {
    XmlReaderSettings rs = new XmlReaderSettings();
    rs.DtdProcessing = DtdProcessing.Prohibit;
    XmlReader myReader = XmlReader.Create(new StringReader(input), rs);

    while (myReader.Read()) {
        Console.WriteLine(myReader.Value);
    }
}

References:

• CWE-611: Improper Restriction of XML External Entity Reference
• XXE and .NET

Language: Go

libxml2 - External Entities Enabled

Incorrect (vulnerable to XXE):

import (
    "fmt"
    "github.com/lestrrat-go/libxml2/parser"
)

func parseXml() {
    const s = `<!DOCTYPE d [<!ENTITY e SYSTEM "file:///etc/passwd">]><t>&e;</t>`
    p := parser.New(parser.XMLParseNoEnt)
    doc, err := p.ParseString(s)
    if err != nil {
        fmt.Println(err)
        return
    }
    fmt.Println(doc)
}

Correct (XXE disabled):

import (
    "fmt"
    "github.com/lestrrat-go/libxml2/parser"
)

func parseXml() {
    const s = `<!DOCTYPE d [<!ENTITY e SYSTEM "file:///etc/passwd">]><t>&e;</t>`
    p := parser.New()
    doc, err := p.ParseString(s)
    if err != nil {
        fmt.Println(err)
        return
    }
    fmt.Println(doc)
}

References:

• CWE-611: Improper Restriction of XML External Entity Reference
• OWASP XXE Processing