CME-1317

XML External Entity Prevention (Secure XML Parser Configuration)

Description

Configures XML parsers to disable external entity resolution, DTD processing, and XInclude expansion, preventing XXE attacks that exploit default-permissive XML parser behavior to read local files, perform SSRF, or cause denial of service via entity expansion (billion laughs). Covers all major XML parsing APIs: Java (DocumentBuilderFactory, SAXParserFactory, XMLInputFactory with FEATURE_SECURE_PROCESSING and disallow-doctype-decl), Python (defusedxml, lxml with resolve_entities=False), .NET (XmlReaderSettings with DtdProcessing.Prohibit), PHP (libxml_disable_entity_loader), C/C++ (libxml2 without XML_PARSE_NOENT), and Go (xml.Decoder with strict mode). The control must be applied at parser instantiation — not as post-parse validation — because entity resolution occurs during parsing. When XML input is required but DTDs are needed for schema validation, use catalog-based resolution with a local-only catalog that rejects network fetches.

CVSS Vector Impacts

Metric Transition Rationale
Confidentiality (C) H N External entity resolution is disabled at the parser level; the attacker cannot use file:// or http:// entity references to read local files or probe internal services because the parser rejects all external entity declarations before resolution occurs
Availability (A) H N DTD processing is disabled, preventing entity expansion bombs (billion laughs) that cause exponential memory consumption; the parser rejects DOCTYPE declarations before recursive entity expansion begins

CWE Relationships

Verification

Verify that XML parsers are configured to disable external entities and DTD processing across all application languages in use

$ grep -rn 'FEATURE_SECURE_PROCESSING\|disallow-doctype-decl\|XMLConstants\|setFeature.*external' <app_source>/
# Expected: Secure XML parsing features enabled in Java XML parser configuration
Platform: any
$ grep -rn 'defusedxml\|resolve_entities.*False\|no_network.*True\|etree.XMLParser.*resolve_entities' <app_source>/
# Expected: Python XML parsing uses defusedxml or explicitly disables entity resolution
Platform: any
$ grep -rn 'DtdProcessing.Prohibit\|ProhibitDtd.*true\|XmlReaderSettings' <app_source>/
# Expected: .NET XML parsing prohibits DTD processing
Platform: any
$ grep -rn 'libxml_disable_entity_loader\|LIBXML_NOENT\|XML_PARSE_NOENT' <app_source>/
# Expected: PHP/C XML parsing has external entity loading disabled
Platform: any
← CME-1316: Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits)