XML external entities: disabling DTD processing in parsers

What it is

A document type definition inside an XML document may define entities. An external entity (<!ENTITY x SYSTEM "file:///etc/passwd">) makes the parser read a file or URL and substitute the content; a parameter entity can fetch a remote DTD and exfiltrate data blind; nested entities ("billion laughs") expand exponentially. The OWASP cheat sheet (cited) states that the safest prevention is to disable DTDs completely, which also stops the denial-of-service variants, and that where DTDs are needed, external entities and external DTD declarations must be disabled in the parser-specific way.

Why it matters

XML still arrives from outside in SAML assertions, SOAP, document formats (SVG is XML; DOCX and XLSX are zipped XML), RSS feeds, sitemaps and configuration uploads. The parser, not the application, decides whether to open file:/// or http://169.254.169.254/, so the vulnerability lives in a default rather than in visible code.

How to apply

• Java: set the Xerces feature http://apache.org/xml/features/disallow-doctype-decl to true on DocumentBuilderFactory and SAXParserFactory. StAX has no such feature: set XMLInputFactory.SUPPORT_DTD and IS_SUPPORTING_EXTERNAL_ENTITIES to false. Transformers and validators consume a parser; hand them a hardened XMLReader, or on JAXP 1.5 implementations set ACCESS_EXTERNAL_DTD to the empty string. The cheat sheet's table also lists jdk.xml.dtd.support=deny for the built-in parsers of Java 22 and later.
• libxml2 (and bindings such as lxml or PHP): do not pass XML_PARSE_NOENT or XML_PARSE_DTDLOAD; the cheat sheet notes that libxml2 disables external entity substitution by default since 2.9 and that PHP 8.0 and newer prevent XXE by default.
• Python: the standard-library parsers rely on Expat, which the Python documentation (cited) says does not access local files or create network connections by default; the same page warns that Expat versions below 2.7.2 may be vulnerable to billion laughs, quadratic blowup and large-token attacks, and tells you to check pyexpat.EXPAT_VERSION. Use defusedxml for untrusted input.
• .NET: the cheat sheet reports the built-in parsers safe from external entities at framework 4.5.2 and later, with XmlResolver null by default; on older targets set XmlResolver to null yourself and keep DtdProcessing at Prohibit. ASP.NET applications must also set httpRuntime targetFramework to 4.5.2 or later in Web.config, or the unsafe defaults apply regardless of the installed framework.
• Whatever the stack: add a test that feeds a document with an external entity and one with recursive entities and asserts rejection.

Pitfalls

Libraries that build their own parser and ignore your factory settings (SAML toolkits, PDF and office converters). Fixing the DOM parser but not the SAX or StAX path used elsewhere. Size limits missing even where entities are disabled. Treating an error page that echoes the parsed content as harmless; it is the exfiltration channel.