security vulnerability_error ai_generated true

XXE: external entity reference in XML parser

ID: security/xxe-injection

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

XML parser processes external entity references.

generic

Workarounds

  1. 95% success Disable external entity processing in XML parser 
    factory.setFeature("http://xml.org/sax/features/external-general-entities",false)
  2. 88% success Use JSON instead of XML where possible

Dead Ends

Common approaches that don't work:

  1. Filter DOCTYPE declarations with regex 80% fail

    Easily bypassed with encoding

  2. Validate XML against schema only 78% fail

    Schema validation doesnt prevent XXE