All 7 XML Handling in PHP questions
More in XML Handling in PHP
What is XML, and what are the common built in ways PHP lets you read and parse an XML document? How does SimpleXML let you access nested elements and attributes within an XML document using a natural, object like syntax? How does the DOM extension provide a more powerful and flexible alternative to SimpleXML when you need to actually modify or construct an XML document rather than only read one? What is XPath, and how does it let you query and extract specific elements from an XML document using a powerful, standardized path based query syntax? How can you efficiently parse an extremely large XML file that would be too large to comfortably load entirely into memory at once, using a streaming based approach like XMLReader? In a modern PHP application that primarily uses JSON for its APIs, when might you still legitimately need to work with XML, and what strategies help cleanly integrate XML handling into an otherwise JSON centric codebase?
Advertisement
Back to results for “Security”
PHP › XML Handling in PHP

Why is protecting against XML external entity attacks, commonly abbreviated as XXE, an important security consideration when parsing XML documents that come from an untrusted or external source?

Intermediate

Answer

An XML external entity attack exploits a feature of the XML specification that allows a document to define a custom entity referencing an external resource, such as a local file on the server or an internal network address, and if an XML parser is not properly configured to disable this feature, a malicious XML document submitted by an attacker could potentially be used to read sensitive local files from the server or make unintended requests to internal network resources, making it essential to explicitly disable external entity loading whenever your application parses XML documents originating from an untrusted external source.
libxml_disable_entity_loader(true);
$xml = simplexml_load_string($untrustedXmlInput, 'SimpleXMLElement', LIBXML_NOENT | LIBXML_DTDLOAD);
Real-world example An API that accepts XML formatted data submitted by external third party partners explicitly disables external entity loading before parsing any incoming XML, preventing a malicious partner from crafting a document designed to read sensitive files directly from the server.

Common follow-ups: What specific sensitive information could realistically be exposed through a successful XXE attack?;Has this specific vulnerability's default behavior changed across different PHP or libxml versions over time?

Security;JSON Handling in PHP
All 7 XML Handling in PHP questions