Chapter 32 — XXE and the XML attack surface

Practice (60 min)

1. PortSwigger Academy "XML external entity (XXE) injection" track: in-band file read, SSRF, blind OOB with a malicious DTD, blind error-based, XInclude, XXE via file upload (SVG), XXE via Content-Type change (JSON endpoint that also accepts XML).
2. Locally: a Java (or PHP/.NET) endpoint parsing XML with defaults. Read /etc/passwd; then do blind OOB against a collaborator you run; then the billion-laughs DoS. Apply the per-language hardening and re-test each.
3. Build the DOCX/XLSX/SVG upload repro from the worked example; fix the parser config and add an egress-denied sandbox.
4. Add a check to your CI: grep for XML parser instantiation without the secure-processing feature (a simple linter / Semgrep rule).

Build it in Go (15 min) — what Go's XML parser does with these payloads

Before testing a service for XXE, find out what its parser does by default. Go's encoding/xml doesn't fetch external entities and doesn't expand entities declared in a DTD. This lab confirms it with the classic payloads, and adds the size limit that no parser gives you for free.

// xmlsafe: what Go's encoding/xml does with the classic XML attacks
// (Chapter 32). Go never fetches external entities and never expands
// entities declared in a DTD, so XXE and "billion laughs" fail closed --
// but you still need size limits, and other libraries may not be so strict.
//
//	go run ./xmlsafe
package main

import (
	"encoding/xml"
	"errors"
	"fmt"
	"io"
	"strings"
)

type order struct {
	XMLName xml.Name `xml:"order"`
	Note    string   `xml:"note"`
}

var payloads = map[string]string{
	"1 normal": `<order><note>two coffees</note></order>`,

	"2 XXE file read": `<?xml version="1.0"?>
<!DOCTYPE order [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<order><note>&xxe;</note></order>`,

	"3 XXE SSRF": `<?xml version="1.0"?>
<!DOCTYPE order [ <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/"> ]>
<order><note>&xxe;</note></order>`,

	"4 billion laughs": `<?xml version="1.0"?>
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol9 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<order><note>&lol9;</note></order>`,

	"5 huge document": "<order><note>" + strings.Repeat("A", 5<<20) + "</note></order>",
}

var errTooLarge = errors.New("document larger than 1 MB")

// capReader fails loudly at the limit (io.LimitReader would just stop,
// and the parser would report a confusing "unexpected EOF").
type capReader struct {
	r    io.Reader
	left int64
}

func (c *capReader) Read(p []byte) (int, error) {
	if c.left <= 0 {
		return 0, errTooLarge
	}
	p = p[:min(int64(len(p)), c.left)]
	n, err := c.r.Read(p)
	c.left -= int64(n)
	return n, err
}

// parse is how XML from a request should be read: bounded size, strict mode.
func parse(r io.Reader) (*order, error) {
	dec := xml.NewDecoder(&capReader{r, 1 << 20}) // no parser is safe from unbounded input
	dec.Strict = true                             // the default; undefined entities are errors
	var o order
	if err := dec.Decode(&o); err != nil {
		return nil, err
	}
	return &o, nil
}

func main() {
	for _, name := range []string{"1 normal", "2 XXE file read", "3 XXE SSRF", "4 billion laughs", "5 huge document"} {
		o, err := parse(strings.NewReader(payloads[name]))
		if err != nil {
			fmt.Printf("%-18s REJECTED  %v\n", name, err)
			continue
		}
		fmt.Printf("%-18s parsed    note=%q\n", name, o.Note)
	}
}

$ go run ./xmlsafe
1 normal           parsed    note="two coffees"
2 XXE file read    REJECTED  XML syntax error on line 3: invalid character entity &xxe;
3 XXE SSRF         REJECTED  XML syntax error on line 3: invalid character entity &xxe;
4 billion laughs   REJECTED  XML syntax error on line 8: invalid character entity &lol9;
5 huge document    REJECTED  document larger than 1 MB

What to notice:

• Go fails closed: undefined-entity errors, no file read, no outbound request, no exponential expansion. The same payloads against a libxml2- or Xerces-based parser with entity substitution enabled behave very differently, so a Go front end can still pass XML to a vulnerable component behind it.
• Size limits are still yours. Without the capReader, a 5 GB "XML" upload is read in full. A plain io.LimitReader would also work, but it reports a confusing "unexpected EOF". Fail with a clear error instead.
• Strict = false plus a custom Entity map changes the picture. Grep for it in code review.

Exercise: wrap the decoder in an HTTP handler behind http.MaxBytesReader, then point an XXE scanner at it and confirm nothing fires. Then repeat against a service in another language from your estate.