XML External Entity (XXE)

// Java/Spring Boot - SECURE against XXE

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

@PostMapping("/api/upload-xml")
public ResponseEntity<?> uploadXml(@RequestBody InputStream xmlInput) throws Exception {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    
    // SECURE: Disable DTDs completely
    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
    
    // SECURE: Disable external entities
    factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
    factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
    
    // SECURE: Disable external DTDs
    factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
    
    // SECURE: Disable XInclude processing
    factory.setXIncludeAware(false);
    
    // SECURE: Disable entity expansion
    factory.setExpandEntityReferences(false);
    
    DocumentBuilder builder = factory.newDocumentBuilder();
    
    // Set entity resolver that returns empty content
    builder.setEntityResolver((publicId, systemId) -> {
        // Return empty input source for any external entity
        return new InputSource(new java.io.StringReader(""));
    });
    
    try {
        Document doc = builder.parse(xmlInput);
        
        NodeList nodes = doc.getElementsByTagName("id");
        String invoiceId = nodes.item(0).getTextContent();
        
        return ResponseEntity.ok(Map.of("invoiceId", invoiceId));
    } catch (SAXException e) {
        // Will throw exception if DOCTYPE is found
        return ResponseEntity.badRequest()
            .body(Map.of("error", "Invalid XML: DOCTYPE not allowed"));
    }
}

// Python/Flask + lxml - SECURE
from flask import Flask, request
from lxml import etree

@app.route('/api/parse-xml', methods=['POST'])
def parse_xml():
    xml_data = request.data
    
    # SECURE: Disable entity resolution
    parser = etree.XMLParser(
        resolve_entities=False,  # Don't resolve external entities
        no_network=True,         # Disable network access
        dtd_validation=False,    # Don't validate DTDs
        load_dtd=False          # Don't load DTDs
    )
    
    try:
        tree = etree.fromstring(xml_data, parser)
        
        # Only parse if no DOCTYPE found
        if tree.getroottree().docinfo.doctype:
            return {'error': 'DOCTYPE not allowed'}, 400
        
        result = tree.find('.//data').text
        return {'data': result}
    except etree.XMLSyntaxError as e:
        return {'error': 'Invalid XML'}, 400

# ALTERNATIVE: Use JSON instead of XML when possible
@app.route('/api/upload-invoice', methods=['POST'])
def upload_invoice():
    # SECURE: Use JSON instead of XML to avoid XXE entirely
    data = request.get_json()
    invoice_id = data.get('id')
    return {'invoiceId': invoice_id}