Menu
Generate secure XML parsing code. Enforces secure parsing of XML content. Invoke when writing any XML parsing related code.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
| name | secure-xml-parsing |
| description | Generate secure XML parsing code. Enforces secure parsing of XML content. Invoke when writing any XML parsing related code. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to xml content parsing.
// BAD: DTD and External Entities are resolved / Internal Entities are replaced / XInclude support is left to default / no size limit
import org.w3c.dom.Document;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.File;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new File("data.xml"));
// GOOD: DTD and External Entities are not resolved / Internal Entities are not replaced / XInclude disabled / input size limited
import org.w3c.dom.Document;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.*;
import java.nio.file.*;
int MAX_XML_SIZE_BYTES = 1 * 1024 * 1024; // 1 MB
byte[] xmlBytes = Files.readAllBytes(Path.of("data.xml"));
if (xmlBytes.length > MAX_XML_SIZE_BYTES) {
throw new IOException("XML input exceeds maximum allowed size of 1 MB");
}
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
// Disable DTD resolution entirely
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
// Disable XML External Entity (XXE) resolution
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
// Disable replacement of XML Internal Entities
factory.setExpandEntityReferences(false);
// Disable XInclude support
factory.setXIncludeAware(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(xmlBytes));
Before finalizing generated code, verify: