XXE follows external references with the parser’s authority

Wed, 22 Sep 2027 00:00:00 +0000

XML external entity processing can make a parser resolve a document-controlled reference using the application’s access. Depending on the parser and its configuration, this can expose files or initiate requests to other services. XML support alone does not establish vulnerability: identify the actual parser, enabled features, resolver and downstream processing before deciding what an input can do.

External access and expansion are different

An external parsed entity can identify a resource through a system identifier. If the application enables resolution and the process can reach that resource, parsing may load it. Reflected content is one possible leak, but outbound requests can matter even when the response never includes the resource. Access is constrained by resolver policy, filesystem rights, network controls and the target service’s own authentication.

Internal entities can instead expand entirely within the document, without file or network access. Repeated nested expansion can consume excessive resources in an insufficiently protected parser. That is distinct from XXE. A bounded thousand-character expansion demonstrates substitution; it does not prove a modern parser permits unlimited amplification. Recursive self-reference is not valid XML, and supported implementations may reject amplification well before memory exhaustion.

Set policy before parsing

If the input format does not require DTDs, reject document-type declarations through the parser’s supported policy or callbacks. Also disable unwanted external general entities, parameter entities and external subsets as appropriate for that implementation. Defaults vary by library and version. Turning off network fetching alone can still leave local file access, while schema validation alone may happen after a dangerous parse has already occurred.

If external resources are required, resolve only explicitly approved identifiers to controlled resources. Review schema imports, XInclude and transforms independently: an XXE setting need not govern those other loaders. Apply byte, nesting and resource limits and keep the parser maintained. No tiny wrapper establishes general resistance to every malformed-input or decompression attack.

When it breaks

A filter that searches raw bytes for the ASCII spelling of DOCTYPE can miss an encoded declaration, such as UTF-16. A textual search can also reject harmless comments containing that spelling. Parse structure with a component that understands the input encoding, then enforce the policy at the declaration boundary. Rejecting one familiar attack string is not evidence that all supported encodings are covered.

An SVG image upload may pass through a server-side XML parser or converter. That stage’s configuration decides whether external references are loaded; being SVG does not mean every browser automatically fetches XML external entities. Check each reparse step, including preview generation and document import, because a safe first parser does not protect a later component that enables a different resolver.

The exact assertions-enabled Expat fixture supports bounded parser behavior. It does not establish external resource access, every handler or encoding, or a general security guarantee.

Check it quickly

Save this as xxe_probe.py and run python3 xxe_probe.py with a maintained Python 3 installation. Use assertions enabled, without -O or PYTHONOPTIMIZE: optimization skips the parameter-entity setting call and positive controls inside assert statements. The example uses Expat callbacks, fixed bytes and small limits. No resolver opens a file or makes a network request. The names inside rejected declarations are inert test inputs.

from xml.parsers import expat

MAX_BYTES = 4096
MAX_DEPTH = 32


def parse_without_dtd(data):
 """Bounded demonstration policy, not a general XML security library."""
 if not isinstance(data, bytes):
 raise TypeError("supply original encoded bytes")
 if len(data) > MAX_BYTES:
 raise ValueError("input too large")
 parser = expat.ParserCreate()
 text = []
 depth = 0

 def reject(*args):
 raise ValueError("DTD and entity declarations are disabled")

 def start(name, attrs):
 nonlocal depth
 depth += 1
 if depth > MAX_DEPTH:
 raise ValueError("too deeply nested")

 def end(name):
 nonlocal depth
 depth -= 1

 parser.StartDoctypeDeclHandler = reject
 parser.EntityDeclHandler = reject
 parser.ExternalEntityRefHandler = reject
 assert parser.SetParamEntityParsing(expat.XML_PARAM_ENTITY_PARSING_NEVER)
 parser.StartElementHandler = start
 parser.EndElementHandler = end
 parser.CharacterDataHandler = text.append
 parser.Parse(data, True)
 return "".join(text)


internal = ('<!DOCTYPE r [<!ENTITY a "0123456789">'
 '<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">'
 '<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">]><r>&c;</r>')
# A bounded baseline: ordinary internal expansion, not a resource-exhaustion test.
baseline = expat.ParserCreate()
chunks = []
baseline.CharacterDataHandler = chunks.append
baseline.Parse(internal.encode(), True)
assert len("".join(chunks)) == 1000
assert parse_without_dtd(b'<r>hello &amp; goodbye</r>') == 'hello & goodbye'
assert parse_without_dtd(b'<r><!-- literal <!DOCTYPE is only a comment -->ok</r>') == 'ok'
external = '<!DOCTYPE r [<!ENTITY e SYSTEM "file:///not-read-by-this-demo">]><r>&e;</r>'
network = '<!DOCTYPE r SYSTEM "https://example.invalid/never-requested"><r/>'
svg = '<!DOCTYPE svg [<!ENTITY e "text">]><svg>&e;</svg>'
rejected = []
for name, payload in [
 ("internal", internal.encode()), ("file", external.encode()),
 ("external-subset", network.encode()), ("svg", svg.encode()),
 ("utf16-dtd", external.encode("utf-16")),
 ("oversize", b'<r>' + b'x' * MAX_BYTES + b'</r>'),
 ("depth", b'<r>' * (MAX_DEPTH + 1) + b'</r>' * (MAX_DEPTH + 1)),
]:
 try:
 parse_without_dtd(payload)
 except ValueError:
 rejected.append(name)
 else:
 raise AssertionError(f"policy accepted {name}")
assert len(rejected) == 7
try:
 parse_without_dtd(b'<r>unfinished')
except expat.ExpatError:
 pass
else:
 raise AssertionError("malformed XML accepted")
print("Expat:", expat.EXPAT_VERSION)
print("PASS: ordinary text/comment accepted; seven policy cases and malformed XML rejected")

Separate exact EN/ZH runs and an independent rerun passed on Python 3.12.14 with Expat 2.8.3 and assertions enabled; this source reviewer did not execute them. The fixture prints its linked Expat version. A baseline expands the small internal entity chain to exactly 1,000 characters. The restricted parser accepts ordinary text with the predefined ampersand entity and accepts a harmless comment. It rejects internal declarations, a file entity, an external subset, an SVG DTD, and the same file declaration encoded as UTF-16.

Separate cases exceed the 4,096-byte policy and the depth limit of 32. Malformed XML must raise the parser’s syntax exception. These checks separate ValueError from parser syntax errors, but do not assert which policy branch raised it; the UTF-16 case confirms the policy acts after encoding recognition rather than relying on one ASCII pattern.

The DTD callback rejects first; the cases do not independently exercise every handler or encoding. This is a bounded parser exercise, not an exploit against a file, network target or upload service. It does not validate schema processing, transformations, downstream reparsing, compressed-request handling or production resource isolation. Repeat the policy tests through the actual application entry points and use a maintained hardened XML facility when handling hostile documents.

Sources

Python 3.12 Expat interface, declaration callbacks, parameter-entity policy and encoded input, checked 2026-10-15.
Python XML security, library/version-specific vulnerability boundaries, checked 2026-10-15.
OWASP XXE Prevention, parser-specific external-resource controls, checked 2026-10-15.
W3C XML 1.0, entities, document types and the prohibition on recursive references, checked 2026-10-15.
Python assert statement, optimized execution omits assert code, including expressions with side effects, checked 2026-10-18.