菜单
Generate secure XML parsing code. Enforces secure parsing of XML content. Invoke when writing any XML parsing related code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate secure code for HTTP request preventing exposure to DNS rebinding attack. Enforces HTTP request not exposed to DNS rebinding attack. Invoke when writing HTTP request code that must only target public IP addresses.
Generate secure microsoft excel file validation code. Enforces secure generation of code validating a microsoft excel file. Invoke when writing any microsoft excel file validation related code.
Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
Generate secure relative url validation code for open redirect prevention. Enforces secure generation of code validating a relative url. Invoke when writing any relative url validation related code. See "security-considerations" metadata for strict validation behavior.
Generate secure pdf file validation code. Enforces secure generation of code validating a pdf file. Invoke when writing any pdf file validation related code.
Generate secure Comma Separated Values (CSV) generation code. Enforces secure generation of Comma Separated Values (CSV) content. Invoke when writing any Comma Separated Values (CSV) generation related code.
| name | secure-xml-parsing |
| description | Generate secure XML parsing code. Enforces secure parsing of XML content. Invoke when writing any XML parsing related code. |
| allowed-tools | Read Grep Glob |
| metadata | {"category":"security"} |
Apply all rules below when generating or reviewing any code related to xml content parsing.
// BAD: DTD and External Entities are resolved / Internal Entities are replaced / XInclude support is left to default / no size limit
import org.w3c.dom.Document;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.File;
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new File("data.xml"));
// GOOD: DTD and External Entities are not resolved / Internal Entities are not replaced / XInclude disabled / input size limited
import org.w3c.dom.Document;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import java.io.*;
import java.nio.file.*;
int MAX_XML_SIZE_BYTES = 1 * 1024 * 1024; // 1 MB
byte[] xmlBytes = Files.readAllBytes(Path.of("data.xml"));
if (xmlBytes.length > MAX_XML_SIZE_BYTES) {
throw new IOException("XML input exceeds maximum allowed size of 1 MB");
}
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
// Disable DTD resolution entirely
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
// Disable XML External Entity (XXE) resolution
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
// Disable replacement of XML Internal Entities
factory.setExpandEntityReferences(false);
// Disable XInclude support
factory.setXIncludeAware(false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new ByteArrayInputStream(xmlBytes));
Before finalizing generated code, verify: