XML external entity expansion¶
ID: cpp/external-entity-expansion Kind: path-problem Severity: warning Precision: high Tags: - security - external/cwe/cwe-611 Query suites: - cpp-code-scanning.qls - cpp-security-extended.qls - cpp-security-and-quality.qls
Parsing untrusted XML files with a weakly configured XML parser may lead to an XML external entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial-of-service (DoS) attacks, or server-side request forgery. Even when the result of parsing is not returned to the user, DoS attacks are still possible and out-of-band data retrieval techniques may allow attackers to steal sensitive data.
The easiest way to prevent XXE attacks is to disable external entity handling when parsing untrusted data. How this is done depends on the library being used. Note that some libraries, such as recent versions of
libxml, disable entity expansion by default, so unless you have explicitly enabled entity expansion, no further action needs to be taken.
The following example uses the
Xerces-C++ XML parser to parse a string
data. If that string is from an untrusted source, this code may be vulnerable to an XXE attack, since the parser is constructed in its default state with
setDisableDefaultEntityResolution set to
XercesDOMParser *parser = new XercesDOMParser(); parser->parse(data); // BAD (parser is not correctly configured, may expand external entity references)
To guard against XXE attacks, the
setDisableDefaultEntityResolution option should be set to
XercesDOMParser *parser = new XercesDOMParser(); parser->setDisableDefaultEntityResolution(true); parser->parse(data);