Beginner LevelWeb Security & Cyber Defense
What is XML External Entity (XXE) injection and how do you disable DTD parsing?
❓ Interview Prompt: Explain XXE Injection, XML DTD (Document Type Definition), reading local files (`SYSTEM "file:///etc/passwd"`), SSRF, and disabling DTD parsing.
XML External Entity (XXE) Injection exploits XML parsers that process user-supplied XML containing external entity DTD declarations:
Attack Payload:
'''xml
<!DOCTYPE foo [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<user><name>&xxe;</name></user>
'''
When parsed, the XML engine reads '/etc/passwd' and inserts its content into the document payload!
•
Defense: Disable DTD (Document Type Definition) parsing completely in your XML parser library settings.
Code Implementation Example
typescript
import libxmljs from 'libxmljs';
// ✅ SECURE: Explicitly disable DTD processing and external entity loading!
const xmlDoc = libxmljs.parseXml(rawXmlInput, {
dtdload: false,
noent: false // Disables entity substitution
});💡Disabling XML DTD external entity parsing in libxmljs.
🎯 Interview Key Takeaway
Disable DTD processing and external entity resolution in XML parsers to neutralize XXE injection attacks.
#XXE#XML Security#Injection#Beginner
Back to all Web Security & Cyber Defense Questions→