رده:موجودیت های خارجی ایکس ام ال(XML External Entity)

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<stockCheck><productId>&xxe;</productId>

<?php 
$goodXML = '<test><testing>my value</testing></test>'; 
$badXml = '<!DOCTYPE root [ <!ENTITY foo SYSTEM "http://test.localhost:8080/contents.txt"> ]> <test><testing>&foo;</testing></test>';
$doc = simplexml_load_string($badXml ); 
echo $doc->testing; 
?>

// In XML processors based on libxml2, dangerous LIBXML constants include: LIBXML_DTDLOAD, LIBXML_DTDVALID, LIBXML_NOENT, LIBXML_XINCLUDE

$xml = $_GET["xml"];

$doc = simplexml_load_string($xml, "SimpleXMLElement", LIBXML_NOENT); // Noncompliant

$doc = new DOMDocument();
$doc->loadXML($xml, LIBXML_NOENT); // Noncompliant

$reader = new XMLReader();
$reader->XML($xml, NULL, LIBXML_NOENT); // Noncompliant

<?php 
$goodXML = '<test><testing>my value</testing></test>'; 
$badXml = '<!DOCTYPE root [ <!ENTITY foo SYSTEM "http://test.localhost:8080/contents.txt"> ]> <test><testing>&foo;</testing></test>';
libxml_disable_entity_loader(true);
$doc = simplexml_load_string($badXml); 
echo $doc->testing; 
?>

// Starting with libxml2 version 2.9, dangerous functionality is disabled by default

$xml = $_GET["xml"];

$doc = simplexml_load_string($xml);

$doc = new DOMDocument();
$doc->loadXML($xml);

$reader = new XMLReader();
$reader->XML($xml);

StreamReader stream = new StreamReader(data);
XmlReaderSettings settings = new XmlReaderSettings();
settings.DtdProcessing = DtdProcessing.Parse;
XmlReader xmlReader = XmlReader.Create(stream, settings);

StreamReader stream = new StreamReader(data);
XmlReaderSettings settings = new XmlReaderSettings();
settings.DtdProcessing = DtdProcessing.Ignore;
XmlReader xmlReader = XmlReader.Create(stream, settings);

import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
 
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
 
import org.xml.sax.SAXException;
import org.xml.sax.helpers.DefaultHandler;
 
class XXE {
  private static void receiveXMLStream(InputStream inStream,
                                       DefaultHandler defaultHandler)
      throws ParserConfigurationException, SAXException, IOException {
    SAXParserFactory factory = SAXParserFactory.newInstance();
    SAXParser saxParser = factory.newSAXParser();
    saxParser.parse(inStream, defaultHandler);
  }
 
  public static void main(String[] args) throws ParserConfigurationException,
      SAXException, IOException {
    try {
      receiveXMLStream(new FileInputStream("evil.xml"), new DefaultHandler());
    } catch (java.net.MalformedURLException mue) {
      System.err.println("Malformed URL Exception: " + mue);
    }
  }
}

import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
 
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
 
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;
import org.xml.sax.XMLReader;
import org.xml.sax.helpers.DefaultHandler;
 
class XXE {
  private static void receiveXMLStream(InputStream inStream,
      DefaultHandler defaultHandler) throws ParserConfigurationException,
      SAXException, IOException {
    SAXParserFactory factory = SAXParserFactory.newInstance();
    SAXParser saxParser = factory.newSAXParser();
 
    // Create an XML reader to set the entity resolver.
    XMLReader reader = saxParser.getXMLReader();
    reader.setEntityResolver(new CustomResolver());
    reader.setContentHandler(defaultHandler);
 
    InputSource is = new InputSource(inStream);
    reader.parse(is);
  }
 
  public static void main(String[] args) throws ParserConfigurationException,
      SAXException, IOException {
    try {
      receiveXMLStream(new FileInputStream("evil.xml"), new DefaultHandler());
    } catch (java.net.MalformedURLException mue) {
      System.err.println("Malformed URL Exception: " + mue);
    }
  }
}