| name | prevent-xxe |
| description | Use when parsing XML in any context — file uploads, SOAP APIs, RSS/Atom feeds, SVG processing, document conversion, or any XML-based data exchange format. |
| source | OWASP XML External Entity Prevention Cheat Sheet (owasp.org/www-project-cheat-sheets); OWASP Top 10 2021 A05; CWE-611; NIST NVD CVE-2019-0251 |
| tags | ["security","owasp","xxe","xml","external-entity","developer","input-validation"] |
Prevent XXE
Disable external entity processing and DTD loading in all XML parsers — eliminating file disclosure, SSRF, and denial-of-service attacks through XML document processing.
Why This Is Best Practice
Adopted by: OWASP Top 10 included XXE (A04:2017, merged into A05:2021). CVE-2019-0251 (Apache Solr XXE), CVE-2018-1000632 (dom4j XXE), CVE-2017-5638 (Equifax Struts2) all resulted from default XML parser configurations. SANS Top 25 Most Dangerous Software Errors lists XXE. SAP, Oracle, and Microsoft have all issued XXE patches for their XML-parsing products.
Impact: XXE enables reading arbitrary server files (/etc/passwd, /etc/shadow, AWS credentials), internal SSRF to reach metadata endpoints, and billion-laughs XML bomb DoS that crashes parsers with 1KB of input. The Equifax breach (2017, 147M records) exploited an Apache Struts vulnerability where XXE was part of the attack chain. Facebook, Ubisoft, and Groupon have paid XXE bug bounties.
Why best: Input sanitization attempting to strip DOCTYPE declarations is the alternative — it fails on encoded variants and CDATA tricks. Disabling external entity processing and DTDs at the parser level eliminates the vulnerability structurally, regardless of input content.
