XML External Entity Prevention (Secure XML Parser Configuration)
Description
Configures XML parsers to disable external entity resolution, DTD processing, and XInclude expansion, preventing XXE attacks that exploit default-permissive XML parser behavior to read local files, perform SSRF, or cause denial of service via entity expansion (billion laughs). Covers all major XML parsing APIs: Java (DocumentBuilderFactory, SAXParserFactory, XMLInputFactory with FEATURE_SECURE_PROCESSING and disallow-doctype-decl), Python (defusedxml, lxml with resolve_entities=False), .NET (XmlReaderSettings with DtdProcessing.Prohibit), PHP (libxml_disable_entity_loader), C/C++ (libxml2 without XML_PARSE_NOENT), and Go (xml.Decoder with strict mode). The control must be applied at parser instantiation — not as post-parse validation — because entity resolution occurs during parsing. When XML input is required but DTDs are needed for schema validation, use catalog-based resolution with a local-only catalog that rejects network fetches.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Confidentiality (C) | H → N | External entity resolution is disabled at the parser level; the attacker cannot use file:// or http:// entity references to read local files or probe internal services because the parser rejects all external entity declarations before resolution occurs |
| Availability (A) | H → N | DTD processing is disabled, preventing entity expansion bombs (billion laughs) that cause exponential memory consumption; the parser rejects DOCTYPE declarations before recursive entity expansion begins |
CWE Relationships
Verification
Verify that XML parsers are configured to disable external entities and DTD processing across all application languages in use
# Expected: Secure XML parsing features enabled in Java XML parser configuration
# Expected: Python XML parsing uses defusedxml or explicitly disables entity resolution
# Expected: .NET XML parsing prohibits DTD processing
# Expected: PHP/C XML parsing has external entity loading disabled