Skip to content

Resolve vulnerability: Improper restriction of XML external entity reference ('XXE')

Neil McCorrison requested to merge remediate/improper-restriction-of-xml-external-entity-reference---xxe-D20240516T172805 into master

AI GENERATED PATCH

The suggested code changes were generated by GitLab Duo Vulnerability Resolution, an AI feature. Use this feature with caution. Before you apply the code changes, carefully review and test them, to ensure that they solve the vulnerability, don't harm the functional behavior of your application or introduce new vulnerabilities.

The large language model that generated the suggested code changes was only provided with the affected lines of code, and the vulnerability in that code. It is not aware of any functionality outside of this context.

Please see our documentation for more information about this feature. We'd love to hear your feedback so we can improve on this feature as we work to bring it to general availability.

Description:

External XML entities are a feature of XML parsers that allow documents to contain references to other documents or data. This feature can be abused to read files, communicate with external hosts, exfiltrate data, or cause a Denial of Service (DoS).

XML parsers and document loaders must be configured to not resolve entities. This can be done by:

  • Ensuring you are running a version of .NET Framework greater than 4.5.2 (released in 2014).
  • Using XDocument which disables entity resolution and is generally safe from DoS.
  • Setting XmlDocument's XmlResolver to null.
  • Setting XmlTextReader's ProhibitDtd to true
  • Setting XmlReaderSettings DtdProcessing to DtdProcessing.Prohibit

Example of safely loading an XML file using XmlDocument:

XmlDocument document = new XmlDocument();
document.XmlResolver = null;
document.Load("users.xml");

For more information on XML security, see OWASP's guide: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#net

Identifiers:

  • SCS0007
  • CWE-611
  • security_code_scan.SCS0007-1

Merge request reports